3d5caf154ee1c1f3389296620be5a16e28772bd48265e4d70bb2e5347e8999d8

Analysis

max time kernel
136s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a12724a55808b6eacc66e1660714506_JaffaCakes118.html
Size 27KB
Sample240527-w1d7taeb67
SHA256 3d5caf154ee1c1f3389296620be5a16e28772bd48265e4d70bb2e5347e8999d8
MD5 7a12724a55808b6eacc66e1660714506
SHA1 75ffc6d0713badc5561745aaafc81fbad1c16bec
SHA512 2e3bf3410c1a3a7c475c4c991d359319b3509f97159afa4d6a23fb2d38947ab4e7f6508865fbf9f83fc5045a918ae0645661aa5dc0160defb1454f6a44c0b591
SSDEEP 384:z+1U9CkZrwtOpecEUsVU4vp/uxV2bX+BCGyiYC2eM3lG+bQcrlfKqwEB/TOqAqq0:94nj+BIDmqWQmfR2gUu08eznQhm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
5076	msedge.exe
5076	msedge.exe
1048	identity_helper.exe
1048	identity_helper.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2132	5076	msedge.exe	82
PID 5076 wrote to memory of 2132	5076	msedge.exe	82
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 4516	5076	msedge.exe	83
PID 5076 wrote to memory of 1960	5076	msedge.exe	84
PID 5076 wrote to memory of 1960	5076	msedge.exe	84
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85
PID 5076 wrote to memory of 3940	5076	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a12724a55808b6eacc66e1660714506_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a1dd46f8,0x7ff9a1dd4708,0x7ff9a1dd4718
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11522985106690774381,4770300183436579514,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 18a6fb6d620f18c72e2cd865bcc4d69b8c5e442db7521c3c6a9fccd39865b055
MD5 f2a294105af42f6d59bba8703ae4716f
SHA1 70ddc22ceaa0dd29e4dfa061711a0da923078da4
SHA512 7539788f129f93319ab81b6592512e996719948b243af24dfe540c0a3a1e9a56b12e6129804f977045cc2da580317b2bd464ef8b035bdefbec47dab1b7a635a1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 3d5b242694ab65668108c99332aa423c010d18b8efbbf878e1f9101b71ed1e18
MD5 ffb1f0768a1e5013252e595d90da370a
SHA1 66c4e938aea2ee0180aa585645d5d70d38d5a67b
SHA512 c81e95238b698e0d8ed0aa1afb38abdc11e39c162c451b3baa1cec375ba1193e66fb82b7b2b0877ba347a247a705a98c98aa44cc943e958ca9963b47c8ab2a68
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 9b79c9bff07aa41045d63122ff102cb95b2eec93bceed9cceb2d2eaad8469ebe
MD5 84cbd5f8b1e694e57848a5c353612b00
SHA1 66346573173eb066e45332e5374afe862db3d765
SHA512 29ba13403a3503e503b5ed00a524623261525fd376082fc472acfe34d78d452311f30a1853f3e26d2eb6a6ce388403ae0907494f0ad71c3867cf2332bfdb990d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ccaf4b198be3588e6ef33e1694e39b6428fe76721c87d73b830cd7913e3c3707
MD5 9cb749b4dad472876c2b2e620a9fe607
SHA1 8bb13ea4b626182994078865733f7c55672770ae
SHA512 18815d452f6140c330a917038132a1846e93c2a24433637c36eeefb088aebcbc03252afb025f55140670330db04625746420209f676ced282b42e2116c1a3acc
SSDEEP 96:nSkEH1Jz9wpvWMoiVmdeD8bU6fGNR2pRnb0TUWQyV+VD7AiEwb:nSkaDz9GWMT8bU6fGNR2pJ0Trg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 79ba6fc700b29ce681406d1c629a2105dcd600a3670e8601bb50c49edb0749d3
MD5 9e8fd10fa75a17f758e5e5e535c13e07
SHA1 72bc7ed4d7dbebc6f7fc44c1e698f73da0d6ea50
SHA512 b2e27a3a76d0f365384336eebc307fed6b0a02d5ea41377d1d42462c8ecca12e314ce37aebcfa1bb50ba8a67a3b5d047d311187313116c6020b49660d0d946ce
SSDEEP 96:nSk5H1ZD9wpvWMoiVmdeHpRQb0TUWQyV+VDCziEwb:nSkZvD9GWMXp60Tro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4a96bffbec81d8c2d81deff1108adcafc0b60df092eebafd3b5478075d9825f1
MD5 6f1e72bf5518f01c6f088c4afc8bee43
SHA1 0631a83f3077fc23075ee11fc4c13af0b248dd66
SHA512 3a9eadf2be481619cd554b2c3d8c8d0a654114f6451690c28f648b7b7b9b91e4fe9842690033b5721e74241edfb9fd607fe8fe914308e2b4875df46c19031e00
SSDEEP 96:nSkEH1Zz9wpvWMoiVmdeD8bU6fGNR2pRQb0TUWQyV+VD7AiEwb:nSkavz9GWMT8bU6fGNR2p60Trg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b7fccd6d1a34f6c0e507651003001f64044b816ea27cb7381dedb1350c111d7d
MD5 57076a362e28380999996f32903103ef
SHA1 086434a6898006446130c32599fd8363f854ecb0
SHA512 a081d80c334d905e08bb6aa88004f2641cdf2fa842650b2311b770019a334ed667f815f5118644b6ed2e710700f4c8451e1b727c10a8080889c544136acbf45f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVEe2RUoPqTl3z2OMDCRHqd:A9iIxuERzA83h09RZxYVqelaOMWRHqlf
MD5 SHA1 SHA512 SSDEEP

Submit Download