99af01bd2086bdb0519836c2513107f1f032f558c70e5015008519bc493b9a8e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4081dca737e2a2055de8038cba15bf76_JaffaCakes118.html
Size 13KB
Sample240514-g5vm2adf2t
SHA256 99af01bd2086bdb0519836c2513107f1f032f558c70e5015008519bc493b9a8e
MD5 4081dca737e2a2055de8038cba15bf76
SHA1 a79eda031b6d694051c135e151ac5245bf88ec21
SHA512 31e525a87c9e971d8b580932b6094b0ce4bddabd245be4779d10d43026ff605048aa886f2adec8d7799ad0eaddff171ee2c0a5753f1642b297a8af61cc34f533
SSDEEP 384:zrhEPIkpdVmumdVIyPhLXQEbkOe/BU2bUiSO7FVVP9zBjTeEqN/:zrhEPIkpdVmvdVIyJLXQEbkl/BUJiSO8
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
1804	msedge.exe
1804	msedge.exe
2088	identity_helper.exe
2088	identity_helper.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 4980	1804	msedge.exe	81
PID 1804 wrote to memory of 4980	1804	msedge.exe	81
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 1532	1804	msedge.exe	82
PID 1804 wrote to memory of 4244	1804	msedge.exe	83
PID 1804 wrote to memory of 4244	1804	msedge.exe	83
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84
PID 1804 wrote to memory of 3156	1804	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4081dca737e2a2055de8038cba15bf76_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ace946f8,0x7ff8ace94708,0x7ff8ace94718
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16075310330866031194,7750887065488181832,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 190B
SHA256 9554ccf55177f7bb765bfaded16311682e6b42bbe914703bf265aeeedf3b7f70
MD5 928719f95fcc3670afce46a5f536ea5c
SHA1 5cf95790a51a7543e58c7ce7893b77662f7c08cc
SHA512 9d306f5a6900de623c177e1714e33c332dfedf3eb9ef9995702f488bece694ff0b56bb69e36284d601e453e93d1b0a0aa50c2b6d9b071df96f36b05a29659393
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 04ab48f345b40118a7b19110943e0abca6fb0724d0bd50a2e03aedc3f0e9cb47
MD5 aee680a74271999b51983b9635304755
SHA1 c46803cb8d8335f88ac5a5ce170c705e2f6bdebf
SHA512 e8b51bdcbbf12e9355107061d6c8dc10d668bbc4227777d0f18b4138293e035bbe24fe111efbdad7cd8b40837dcb2b6326744acd640bfe07f10ed6e5742f836a
SSDEEP 96:nPkHxm/pnmq/1r4juwpvWMoiVmdeHvSSO3R+UWQyV+VD7AiEwb:nPkMwMt4juGWMXU3R+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8b1eb978f77a58fad56eddd4641da06a08bbf7686c02bbedae9eb927fef1c0db
MD5 23ef959dd10b87a2ef9975d3b6a56a26
SHA1 f467f71c7789a67c213a7ca4d5cea517f7fc8e4e
SHA512 12b26b85e8fcfcd776d31fddb6cbcea9eb7fd5562fa1d8a801667b97ad28ebe14ba1c9aca328038c086897b51ae0cf68fe209a6e80a7f7fdc18a99dd715b6e0b
SSDEEP 96:nPkHxm/pQYmq/1r4juwpvWMoiVmdeHvSSO3R+UWQyV+VDCziEwb:nPkMCMt4juGWMXU3R+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bc367803281bf3ec0e4c45e61bc2bd9e2aa20dcc6a2b9460194a7410cf3ee271
MD5 c1008f278a8f0f8c86985a419535b65d
SHA1 79579758f1553f1be645c2052d3f97af001d1fc1
SHA512 643616186968fcacc0ad2b238b6b52940aaf2d0e98ad4ebe2d2271118a3c2a02728b2d903ab790e257d5c72793d4e688f6b57cbc8db415685ce3d9b3a2d09c2b
SSDEEP 96:nPkHxm/pnmq/1X4juwpvWMoiVmdeHvSSO3R+UWQyV+VD7AiEwb:nPkMwMl4juGWMXU3R+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8c54d0cdc10ac39c8a9cedb7f81d607013e2064d7ac7483f0bab60b99c3e35b1
MD5 f7a156911ec0d178ad27c0d824b58cc3
SHA1 3342ecd1123230c2f842124ed7ffc597060651e6
SHA512 afc1d42595b563c5fd8d423327fe72546c960ac8d3e7b228c00b89e5ec485cf2e081227a20fc68f87e2378934ddf7cc2f398c3666de22655b49448b7b047bd3e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZ0e2RUl/4ua+OblfBhDaaE:A9iIxuERzA83h09RZxYZ6ULa/XDafEBE
MD5 SHA1 SHA512 SSDEEP

Submit Download