8d77e8997fcc3dcc740fce0fd80e66e9c4b48373f91a8271b77957d0fca5f793

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25726498c198e5ce89a276c3f63693e8_JaffaCakes118.html
Size 158KB
Sample240508-snkbhsae8y
SHA256 8d77e8997fcc3dcc740fce0fd80e66e9c4b48373f91a8271b77957d0fca5f793
MD5 25726498c198e5ce89a276c3f63693e8
SHA1 d7179ed8dace2cdf0ba1f344fa3659ab23a9fa0a
SHA512 e643cb57b3a9342236edc3af9db41f8f9614d156db432899330dc50938d72f02c8b23465cedcb442a3ac9c4d70df48bfda74749dad2b2aa0ea7faa093fcab617
SSDEEP 3072:sZlYu8GPbeCJjy/9mPSAt5fedfARUa+S94nAnWhY+CAMOHBL:sZlYudjyYbXU7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5960	msedge.exe
5960	msedge.exe
3412	msedge.exe
3412	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4972	3412	msedge.exe	79
PID 3412 wrote to memory of 4972	3412	msedge.exe	79
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5568	3412	msedge.exe	81
PID 3412 wrote to memory of 5960	3412	msedge.exe	82
PID 3412 wrote to memory of 5960	3412	msedge.exe	82
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83
PID 3412 wrote to memory of 6072	3412	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\25726498c198e5ce89a276c3f63693e8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa819846f8,0x7ffa81984708,0x7ffa81984718
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4452656421501876896,5390404633672095962,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 46KB
SHA256 43337a1354f376890cdb73f3dbaf95a8027761c574c30cdecb321096be485d3e
MD5 ac83857f0497a4a0e7669329827cf228
SHA1 18ea483c966969e43a654fcadea9719a8aca370c
SHA512 6a35c50764d31d4bac07ddbec2329238cd04f2c58c00629e523ae7fc2a7d6be5d1226f8fb6c3c1043b215c38c47951a66fa8a9d4f4d6ddce7664bd1d011db2aa
SSDEEP 768:v78x5bTZt45KRCBTmYRsfAYRnZECrjp0J+VdUei5tDn5X8gJatZl1fb7b1:vIPTT45KRGT9gZKCrqJgHiPnh9wtZrDN
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 95KB
SHA256 acc853579ffcc2a6515cf5a2c59b182c5ccb3e808689119e6535ea33c32a8677
MD5 ddad9f197851bb0b70bf06491f11f11a
SHA1 18091a06704f3f44755b8abaa003a037f234523f
SHA512 b6221df22d58a762dbe08e4fe460da6e711c0b3dc89c8ac241e5a06461e323ee714d7cd817f4881320f2b11e28c42c059eaa78048d103fce223c44d219545ddb
SSDEEP 1536:OOdqfEsR+MzJMfMi7G9+HEORXXN+O2rdLPvf+UkPAzCj2mq8yoConFODb4Zf3eGP:jA8MKfl7BEut+O2pLMAzCj2j6Cot3CU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Size 40KB
SHA256 1c0c57ffa35d64b3606683725c13ae67e58456253e99030e444d6bbd46d6d698
MD5 5c6915af5fc1a2f3ade5d21d864d650a
SHA1 7459091b99d32474141b9a324bed7c2831353d5b
SHA512 ca59484c79701a9e1c7c57d1c6047eb79c746354c081f6a19bcdac9479626255e09b9b357d9d1cac830c386ea32443cf677b2964bed8b2a55e3670bcf7ddb16a
SSDEEP 768:zznaC0S3xL3KmGLYSKhxDefA2ihGqfz9fNf2gZXpFgp1ifuzof2liNJ:PnajS3x3K1JKPCwhLfZd2kZ6p1iUlQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 07c20b2ef977fa540cfaf2dfa29eb562003bcae64c8829c29e5ce68f7353e6ab
MD5 27e455d5d0c589f3ef60650e033e5d96
SHA1 c92fbef62467752ffd39cf98224eda3938f39537
SHA512 5a3c5443b1ec71c69c5c0345757ff8d3f4ab1247ea8078ebb170e025f711d95cc8063ad6798b2d91d4b590a8bd00a9e2b2c0665fb461968ff4ac1f540ecca193
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 d94b85b38f451f2e6059bec13f2c99c6cfb7c9bdcca9e9f9bbb35099574b599a
MD5 517e0db9b1157199a7ab10667ce3fa6d
SHA1 51d30e6c5bd97bf1e83ce2a6ee81cfa017ab0eca
SHA512 4344ff3e3d79a6ea7ba4ca6e32cb9ce237193246996a253736c935341c5cb70af34723316a03c7cc9acd294c448ac0b27a835620e2bfc4f914837e9af5ce7ca2
SSDEEP 96:Js8DwF8h6rFCknHTU085rGp0GpaGpSGkE0YGnGfPGDG9kGpLyGHnGhGDZGWRP:Js8DwF8h6rFCknHTUF5rI0IaISIDquPR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 9b8aebd484bdd18ff980d4bb1a0c9e29671b1b395a47f332547fca54490c87c9
MD5 0615b6111cd5779665a63d4ba4bccd63
SHA1 6946400ada6d6c84601a642e149b33dcebfc2f28
SHA512 d6fdf64c6dd8e579b9a92f9b344fdc26e79f8bff53eb8a0096dbf1b922a781772cd7a5aed16c705b6b948a8f32bfaf0e615b2f6d217cd17813a154fb855b9fd5
SSDEEP 96:Js8DwF8h6rFCknHTU085rGp0GpaGpZGKGkE0YGglGfPGDG9kGpLyGHnGVP:Js8DwF8h6rFCknHTUF5rI0IaIZBIDFlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4687c47f8378944aab6b9290d920ac70b4ca4b6b626a80134403f99d1665bfca
MD5 48db3a56a6ac95121c35ef0bb5e86a2a
SHA1 59d060570a5948dc4c43556d769e0fd718b4f318
SHA512 c50cfba206ea0111b255a01ba425b55b25c43713778fa6645f72ab8354d52a49a9c5f494fc2ffabf3b832e174eb317f25bc8f16c007fa611dea997204bb05d9b
SSDEEP 96:nrkgQ12oj0wpvWMoiVmdeHmQI7UWQyV+VDCziEwb:nrkJsoj0GWMXYro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b5e103eee4845c7a21cec0bee59ba73b11b19f098a236cc50e56903693a280a6
MD5 0dce30b3bcfca6e56bbef3863b977fc8
SHA1 9b3dd72c825bbac007e5817a5f74a12ba8d91223
SHA512 a4c832e8e6229bc43880b0684c62443c9f5872b832332a7456ee936423f2b2a18bf6aeeadc5f5cd70187a135c33e3c6410f2b043d08a7be539095ce9dc803c81
SSDEEP 192:nrk9sYj0GWMZeNj1pb7pcaHwtKa0Q4BrLYHFLkMErN68j3LH2YrV:nrcsYtWiSjGJSuyrH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7186bab9b9d4cecc646a10192e182be174f038ff54977ec8944d5286fcac8884
MD5 fe7a95eab5a6a023698f94374512c250
SHA1 b2efb581957cea33225ed9146f9afae6e8a25fca
SHA512 d1cdeca1347e82d14bcf01f8b2599837651ad4139b193d8bdcf879f1d237071c5a906dbd989d4b80040e6bda384371eaf1b371f9909341f6f5f2bb0c5afe2134
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupK1Ze2RU7IKbe+OblfBhDas:A9iIxuERzA83h09RZxYKrKe/XDafEBxR
MD5 SHA1 SHA512 SSDEEP

Submit Download