1ba20feb2c120477bf8a60016f556a7e1ebb48ebba560054d843be6bd28fd752

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7804763ccf63d1a14dd8beab517be7cb_JaffaCakes118.html
Size 175KB
Sample240527-fxfngaac72
SHA256 1ba20feb2c120477bf8a60016f556a7e1ebb48ebba560054d843be6bd28fd752
MD5 7804763ccf63d1a14dd8beab517be7cb
SHA1 11cded2c22869995c20646b70d705313be68d107
SHA512 d5622a17e346b7b928b2aea116ee167cc1b4600d138590f9c4afe332e3b678c4a3968ff3d716de9380c4a882168cb02ad81d4305f1b2e15c939660afdf1eab6b
SSDEEP 1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3QGNkF1YfBCJiZb+aeTH+WK/Lf1/hpnVSV:S9CT3Q/FgBCJiWB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4456	msedge.exe
4456	msedge.exe
2552	identity_helper.exe
2552	identity_helper.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 904	4456	msedge.exe	83
PID 4456 wrote to memory of 904	4456	msedge.exe	83
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 3488	4456	msedge.exe	85
PID 4456 wrote to memory of 4600	4456	msedge.exe	86
PID 4456 wrote to memory of 4600	4456	msedge.exe	86
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87
PID 4456 wrote to memory of 3152	4456	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7804763ccf63d1a14dd8beab517be7cb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86ae746f8,0x7ff86ae74708,0x7ff86ae74718
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2672 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10050567029304271777,15183343341180023187,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 7c62f49898a47d52243f18b12055b6afdbd1fa0f1cf6caee344644634f0df3ec
MD5 e0c86579ff1202b8c036fb1d35bf90c8
SHA1 eeb05abd6ed0fdc9ae7c458e1e5e6ddc4414d137
SHA512 ae2dac6d1489d491fa599c36471f7837794f0540da570ca2bbc583c12219c4f669535ff1e26746606182db907749bb145d6e944cfbc4992b04a0b080cba4c03e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 4a1dacb32de2e63af3151b064500787330491a9b7f5317be991fdd38458ca601
MD5 a01bd3f33a1ac912f1c4989f12e31bc7
SHA1 14c3e2b014f6a054066c84ba432a8ada3fc4f542
SHA512 e49e43df06b57d05ce28e7ca02a242d554ad9f0d39d3d469b5d38d35eb1a5a04e90f2103c69b699e46e27f92a410ef211079e879206abb8193e01260016993a2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 d8d09daa20413fce6cb208ef2579b2eeb12977e81b13884b8c0ff0a0a3722df5
MD5 4217d1fe23e441cf4c8e4808dde4f49b
SHA1 0347beac14123475f22765944567b6d9a9de99aa
SHA512 76ca61b615c5769679c7168d05573f584c157bae963b38a004c769232a43fd74c7f474cbaf92a121e61afad45eaf457828bada260ba5359e4e14f36301e7a3f3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 955097e7b625cbc563c34dc7ef408b5b54a16fbc63608256f6984e970c106262
MD5 04320e8228a5c0ba5596ffc0fbe92868
SHA1 a72c5e3b106395424c9c82dc2b6edb1f637c3b69
SHA512 f3c05dbdc1f1895c371fc4faf822abb281fbce2e6dae5222e7be598beacd8abdd98a24a0ffb9953b10c7680afcf2035ae7b828685da7233e828a7b7d7b5e8f2f
SSDEEP 96:nvkiYn1WgjuwpvWMoiVmdeHvSSeEFgUWQyV+VDCziEwb:nvkPwgjuGWMXgEFgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 5a12be05f1ceaaaab978ea8f213348a5c30a96b5daa1995a92255f96223bccf4
MD5 512ef0bbb53ac1d9f57d6064421a4fc1
SHA1 c2ce6fe8023b5c86d1d9e57ecdeb078edad6e973
SHA512 c42d6e21d442677fa78d89ea41ace486f5ecb3d7cb60df706abb3da2e186cbb4912061d4ac6755eccd4f65eba540a872b6c2a265069a74a6b6cb2d57382ab1ca
SSDEEP 192:nvkSwrjuGWMdz0YFxJEr7EZUwf2gEFgrg:nvfwX/W+irQcFF
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7543813321fc861aa4a71aec17af2d9418d69b6bde1dc7aeb2c3bf0586d9b862
MD5 d4d08e792b82fbb92cf0c40466fefe89
SHA1 dfb6812b3de493b2db5e650d209a831590e9ae79
SHA512 6a95a009e4fb6ab9606b1d791ed18bbce88aa1fc1420fe7147ca51b7f1c1ed9638355754e20891b2c9016b02e257ca3f81b02f7f5f15e820ef1b74c213291287
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQ0e2RUYG4uuF3z2OMDCRHv:A9iIxuERzA83h09RZxYQ6OWaOMWRHql6
MD5 SHA1 SHA512 SSDEEP

Submit Download