e21bb8bf272fe86acaff7526a1ec23a60efd8ecd84937250b16c52f8a25b6539

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 04:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d671f5092a158d947dd4d9443b1ca4d_JaffaCakes118.html
Size 167KB
Sample240510-fcdclsfa38
SHA256 e21bb8bf272fe86acaff7526a1ec23a60efd8ecd84937250b16c52f8a25b6539
MD5 2d671f5092a158d947dd4d9443b1ca4d
SHA1 d8d3aac9dade9a216621a4d30c024e40557532e1
SHA512 2e440939b6fbe99283399567172066168ed1fe952c0b1be2605c5f2d5adfa1affd36fcdf4c99035e01300f45852267454104af179b414fcb30f7e00f22fc7741
SSDEEP 3072:AhxbjvG83mAGXmNJUzMVkuFr8hBFVZ9mE1nDCc8STk8zXj90hMaKurTn4GluuIyr:SYXmNJ+zFVZ9mE1nDCXSg8jj90hMaKn+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
1156	msedge.exe
1156	msedge.exe
4996	identity_helper.exe
4996	identity_helper.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 3148	1156	msedge.exe	82
PID 1156 wrote to memory of 3148	1156	msedge.exe	82
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 852	1156	msedge.exe	84
PID 1156 wrote to memory of 536	1156	msedge.exe	85
PID 1156 wrote to memory of 536	1156	msedge.exe	85
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86
PID 1156 wrote to memory of 5080	1156	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d671f5092a158d947dd4d9443b1ca4d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed44d46f8,0x7ffed44d4708,0x7ffed44d4718
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14418821766660342038,6611848942362338922,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 3f8a1db885fc8a9ae9c6a459606498e4e00958ee112d2486f86253d13c511701
MD5 5fd128c094c8f6cbedb2bd8043c233f7
SHA1 76ed0c70d5925c3da58cbaed5c2ed58d1fcc79c4
SHA512 25c4c18ff3112f6aa308809f5464788073eb83ab556a15306c6cda287a343087d3784dc2605656d78d640e8c3d8c8f29b04419b16c4d99b465f52fba4c437c8e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 8da986e3facea442f22b3f3c0fdbd4d03e632fefc3d448fd26efe62b18561ebb
MD5 669704c0481cd8d4c2f54b6e2981ef11
SHA1 0b540ed6f40c9b8fdd7b9970d5562de65588ed10
SHA512 86e1e640e461fff6a35a44b2114323e377ed146d3656356064fd83ee3f7778e152383a5e384661e8cb6c923b8da0de6a9d2057531134db4da3d9405662b3d41e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 ae77938d5368f26d71eec68364f9d2fa6f87f61a60bf7f44f223718340038b33
MD5 de0d3e742c8c78f0a4c33aaf5eb0d880
SHA1 6cb0538ca46ee2419ed194960d7482c054dc0889
SHA512 c392aca6ffff284ad28efb45b1577228ab528ccf06c19974488b9cd9e4b648b62ae4e3317bbee20c33472a4f358e28419d95529fae317ec377204f262a238def
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 eaa67d2e121b89383072f6d4672e7ee4d3bc282f6c009715d33bcb2f0fa55c37
MD5 a6f6ec1cce9ccefa75782610341f60ae
SHA1 7a86867d2ad74de9494486735d968bd73f0f2052
SHA512 3b6edb3dffc3754e7d77c4700663ccecbba7e8b2ee63c8e04a63d940f7cd65929c94a79b25ff4a2ab26cd13aa07130d08d161b81fc95ba3ec4e7ba08e225c167
SSDEEP 96:nXNk3xm/pQYmqnr1p1wpvWMoiVmdeHBrzq/dUWQyV+VDCziEwb:nXNkcCer71GWMXU/dro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 c705f07c7117e630aacee414276f05f5bf179e96cc809f1edbedc33f1868d5d3
MD5 5525348a6d5eb2f0c8cb84d2b0e42cae
SHA1 e46fd29c2638541406d8ef4138c47c8dbfcf4c95
SHA512 bddfc7b7cf9858cef3667b562fd15648dcb69080891619e236ccd701fdbd365426b50963406053dbe070d1ef5a4a64c476be545f23a266738c78cb9611c83d36
SSDEEP 192:nXNkcser7sGWMO3wW5cETMJvKx7yqErJoaYJbt31fJ2U/drg:n9v75WCd7ryk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9fdf971c565401fb09f9d1957deb7ea444d97ef8799e1d8b55cb6042541a4270
MD5 c4a13c13bf948d9306cbf2352105deba
SHA1 0ed28455d7828869c3011d1ac3367de2efafa112
SHA512 9dddf8126f01d25cae522b0c931bd76daebf9d518072a57c7ac731daea518c04c15dc7bb31648d0bbb1d0abb5e9a57e6d390202b240753b55b90b46a4bba9a66
SSDEEP 192:nXNkcwer7sGWMO3wW5cETMJvKx7yqErJoaYJbt31fJ2U/drV:n9D75WCd7ryZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1a57efba7635b50394e44eab887882b3b0a9b83ce0355cfc73850476ad9fad3a
MD5 a3cead4b6ea42c706a4b0a881556ae6c
SHA1 68c27f61d1fc288f0eebe4be5387a936a827cbb9
SHA512 533d23577c3b4e8b8896737a4d440b380eca627fa295779debb3dbc51e672153744a1e67d03461b48dfe61a5367ba5acccb45123f77486a734aeb8557b415898
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6HXLe2RUt6wlMj2uP+OblR:A9iIxuERzA83h09RZxY6HL1RyE/XDafs
MD5 SHA1 SHA512 SSDEEP

Submit Download