8da348b723c8c0f65ef31590dac22998fe16acb840684dc49a4e93db0502ec7b

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7907785cfa5f16ad67944397fdd5b88a_JaffaCakes118.html
Size 168KB
Sample240527-nsvwlaba24
SHA256 8da348b723c8c0f65ef31590dac22998fe16acb840684dc49a4e93db0502ec7b
MD5 7907785cfa5f16ad67944397fdd5b88a
SHA1 9eb9e90a2c96228eaf7b1a88e48b54b3fa9481fb
SHA512 46123d36c8b4ef81d5c59c713960cf92215cd847d80b38e4a60e0759c34782d02c05bc4ad21b0d6b4ddc4e5e2c5e49c975522f5e686bc2afb7a575167e497847
SSDEEP 3072:CHhfaWYF1fp6wCpcg2ccKz/eHjo3jAuQrU2ry8ZFAQOq1kkxf6xWeSLg79f:ShfaWYF1fp6wCpcg2ccKz/eHjo3jAs2E
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3316	msedge.exe
3316	msedge.exe
5048	identity_helper.exe
5048	identity_helper.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1524	3316	msedge.exe	85
PID 3316 wrote to memory of 1524	3316	msedge.exe	85
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 5036	3316	msedge.exe	86
PID 3316 wrote to memory of 3412	3316	msedge.exe	87
PID 3316 wrote to memory of 3412	3316	msedge.exe	87
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88
PID 3316 wrote to memory of 412	3316	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7907785cfa5f16ad67944397fdd5b88a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb327746f8,0x7ffb32774708,0x7ffb32774718
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13611916907405923243,14811298522326400417,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Size 203KB
SHA256 587b3b00f7a583ddc1559e8e4f94b9aaaf835761ff73ac8ea51329d66540c1b1
MD5 5290675221fb33c424df93fe19249379
SHA1 f8b89b7a25c6bcde767272243acfebbee331e545
SHA512 12053a4b421d825b078742e1c8a48fee99a5e587588cc3189e3ecec8400c928485769a724dd554f712a46bfe22037ab71fda8f4ae875b4f8f4c6b4963a8083f7
SSDEEP 6144:Qf874idqqbom9UIl85wjwbhP+oly2dknOM:Qf4Fom9edhPn8JOM
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 d6c21440b337dcc4061f2d4af0235a77f665fa5286805d93cdd777c9539b2464
MD5 375eb151467ae9cc1c7c0365ebea3cbd
SHA1 7b4ee000045cef5de717c12531d9a9361ac24cc1
SHA512 8fa3bbb353c53ff87b7e4d7924cde7f50ba47e421e1f66aebb93b12b9652b805d42c7c0a7d2bac13aa2cdbf8e763d84506ed44fd4263ac32d9159ae11c0b6edb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 224a7dbd149bd2b26b5ef3c0fdec6b0b14a45d689e1e5d8c20c416813859cc19
MD5 937d24b91f163bf0c7b48339d70e0f70
SHA1 aa42b4be70aa1175fbe46d40ab35ee5755f5fb67
SHA512 efeb967ba45a0c6e90df919764acc73214a3f9d4f1597702407fdc93b6d0aabd7a5f8d21901abd57a8ebf616f1d670b0e30f789932a6c6a635bcb5fde0c99ae1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 aff95d58f26ceb11a9a78b06dce15b294987e197671469cdae2d356997517c81
MD5 8c6f812db09945d5720f75f430866458
SHA1 f680b3d3682157066f5a476d0275e6846ec36a30
SHA512 c7717af26354f706afb5282180b08f8a68a67e89fd772105a808ed4a4f788275d33dc6b63908e5c10e0a30f5523b8f8ff7525985879df3ebf705356d47f54193
SSDEEP 96:nck5n1M33XwpvWMoiVmdeHp1knu+UWQyV+VDCziEwb:nckpanXGWMXpKu+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6251c0014251cb221503932faf3c01892f503cc9cf39d3632711bc3bf6e56f75
MD5 243c6c4299a7659e930c44b0f9e3365e
SHA1 75753c3f91c319e9eb89569f86eabace9eee6041
SHA512 6234ba08f1c7c421294e167a2297a71210cfce795d179a03f8f4bc6928ec64558ac5fea9f735132cb41545e234a71712b640718ee520dc08359ef5ca89b5f4e5
SSDEEP 96:nckEn1M33XwpvWMoiVmdeNpJ+E0kauN0+2p1knu+UWQyV+VDCAiEwb:nck+anXGWM9pJ+E0kauN0+2pKu+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9a6267b656dd4c675d12824b4b71b36a5e1db62f10f7c486957f3db2fba27813
MD5 19c1b816820c1135aacced08a82ab409
SHA1 63639992bcb23f323e0d33908e3e5a36c135bfb6
SHA512 25d7c4e98932b048b8ff303d27c927f6444f92295ff07f194081e79900bab6c8b161f248c7812fcfd8e400b5fca477308535ed9637df40f4d9c17580a4c6b164
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMq7ge2RUGo5F3z2OMDCRHQ:A9iIxuERzA83h09RZxYMqqsFaOMWRHqP
MD5 SHA1 SHA512 SSDEEP

Submit Download