243d6d9737c11c4cad57591f8c557e3c8c66bca094a1f1e9a2d594bfb63204ef

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7919a80a82e35569e5138ff4652c75b5_JaffaCakes118.html
Size 46KB
Sample240527-pafvdscb97
SHA256 243d6d9737c11c4cad57591f8c557e3c8c66bca094a1f1e9a2d594bfb63204ef
MD5 7919a80a82e35569e5138ff4652c75b5
SHA1 c706a7ebf1cdaf97ded5978562a380e20fa0624e
SHA512 1989c1ea7a12239bdb1f9934138d5c0637cefa0211c98761719364880066f1dd53deb24b4f40855d11a167c95a8d46d637dc88ca966775cad5eed92395cbc023
SSDEEP 768:h6GbMb2QJykMvn0xJMWdAikcoAikchnzC8vMV4ZVm/CB9fGRxDPXEl1sfTbwP7LV:h69JrMYAikcoAikcWV4ZV5YxDPXElEQP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
1272	msedge.exe
1272	msedge.exe
3352	identity_helper.exe
3352	identity_helper.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 4988	1272	msedge.exe	82
PID 1272 wrote to memory of 4988	1272	msedge.exe	82
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 2072	1272	msedge.exe	83
PID 1272 wrote to memory of 3480	1272	msedge.exe	84
PID 1272 wrote to memory of 3480	1272	msedge.exe	84
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85
PID 1272 wrote to memory of 4648	1272	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7919a80a82e35569e5138ff4652c75b5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc801b46f8,0x7ffc801b4708,0x7ffc801b4718
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9262154732757306465,6295681180796987194,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 aa3a4c8a8c9bbecca5e17c0c514fc58f9de9f8d59df47f80566c36ef4ee165d7
MD5 3c70b708088ba75eb059a8c5f335b40a
SHA1 37672b029af19fef0b48633230f27b3301163987
SHA512 9275a6690847e5dd9638cb1a885ebc24cb195c0232d91ad487a7c6ec17ae6dcb2fb3283daabcfa4edf104b49c4cd0db1961fe7a957586ebcd91ad285a7ed9258
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a2d76a8fe874ec0341b0f0e859c066633251948c774fc05f222c28483bde9112
MD5 ec20481d7919492e0856d072bff11712
SHA1 80dbf0902f061bb0e01008b1c3138d59c17fb929
SHA512 f721c84fb1056d43fa25f8ff103948612eab20834e4991f99a7a637b429c8e9d0350b62aa600a795d05b75d4573e38c81282ff90a43a89f2959d0e70ef3d4cd0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f30f74e5226ce9b0bba7107c3a0ef2338484f92eaa810f5e64e2cdec8d9f8fc1
MD5 0a89c3e5a78bfd6c5a6e69a829e57030
SHA1 4c8908e63a59711cad1dc42d97dbe0245b762df1
SHA512 d0744cf9dfad3012200dd67e4429c0541fbc89d70eb1b7cb97de328eb8f5e3cb8ea47f004e2b373b50e6d8f5b7aed023a46cf3b2ee1e4541aa018147fd7fd523
SSDEEP 96:nnkpk1Z73wpvWMoiVmdeHplwt1acvUWQyV+VDCziEwb:nnkyfjGWMXpAXvro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 444879b2f407a3513c4d4f2e8eede036f58c980f16028cb58882633cf07cb59b
MD5 d6436f2b1ac18dd083f490767c12b413
SHA1 dde6059b6b1056463f6157cc4912029c19803af9
SHA512 2d3923a1cc5d4730cb1273258650996667f5e33095077934a6040ea89c2604f84e685cfe1e8a34c52d09e2f0a38885c462cece050bd87fdfd76ec9517ad784c9
SSDEEP 96:nnkMk1ZOT3wpvWMoiVmde4qjV6y3UdvLvg2plwt1acvUWQyV+VD7AiEwb:nnktfOrGWMIqjQeUdvLvg2pAXvrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e7ef4fe321dc355f83d6ee355e4a4a9c0c9a359f4101d9e8489f479b1adf9b9b
MD5 2a8e0f91714b704a8a1b51e7ec7fd40f
SHA1 94684bfea2289b0b643a670ee228bf7121542fe1
SHA512 f3cedbd854e9822c877efb65e083a07cf0dbfec9d5dc9c7be0c4733f2ec0b4894bd871404638fd7d33ff03cbf512b17cfbbcec3f70825d04b25097d7681c4339
SSDEEP 96:nnkUk1ZOT3wpvWMoiVmde4qjV6y3UdvLvg2plwt1acvUWQyV+VDCAiEwb:nnk1fOrGWMIqjQeUdvLvg2pAXvrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d408248abc23996410d8673a9191e8859c4558d84a6b69c79f1190ada1d2d7db
MD5 7eb64e20ec09cba132777909274a168e
SHA1 b90d4738cef1d004f45110899425006d7dfd9f66
SHA512 3fa29b6adced8593ff28a8eb3602b295b7d5b7124ec9ff05fe5cb9b73d1ee4f7d9c75f0487cf632ed4989d07b001571f63520aa261b7fb247ed06f73ab8e9e7c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDpe2RUK2Z03z2OMDCRHqle:A9iIxuERzA83h09RZxYxq0aOMWRHqlWd
MD5 SHA1 SHA512 SSDEEP

Submit Download