670b47b34dc355f029ad20299f99ac0ef787917fe43b58536dcef00a9ab7d511

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8121e25fc9404cd66edc0d4f021f3499_JaffaCakes118.html
Size 12KB
Sample240529-scd1csaf48
SHA256 670b47b34dc355f029ad20299f99ac0ef787917fe43b58536dcef00a9ab7d511
MD5 8121e25fc9404cd66edc0d4f021f3499
SHA1 c47667f2b954e8ff488b32de165b645feee95b84
SHA512 4dc1791df3bac2b19499192f3d9a8aadc26e4178719e89b42bf070b740060101c3f7531f23d4d158ea40e4a1e60a4589afd1d25e94ea8928b0239d1f5f5d868e
SSDEEP 96:UV6iaf126WFUI060MC9gaY7zvoZQarjLEbRUI4LHlQTSO/rWBrNTKMO/XD1h5Els:VZt7I0KC9gaYvAZv/6RUa2hi58kD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-711569230-3659488422-571408806-1000\{5303B527-138B-4D21-9220-EEFA23FF4F52}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
504	msedge.exe
504	msedge.exe
1340	msedge.exe
4440	msedge.exe
4440	msedge.exe
1952	identity_helper.exe
1952	identity_helper.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe
504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 504 wrote to memory of 1360	504	msedge.exe	84
PID 504 wrote to memory of 1360	504	msedge.exe	84
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 2232	504	msedge.exe	85
PID 504 wrote to memory of 3052	504	msedge.exe	86
PID 504 wrote to memory of 3052	504	msedge.exe	86
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87
PID 504 wrote to memory of 4740	504	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8121e25fc9404cd66edc0d4f021f3499_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff28d446f8,0x7fff28d44708,0x7fff28d44718
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2454239868498319699,9388637933315841252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 2fa44e74d429bf940d20b77c278ff4c0feabbcf46852d2713474f62f02282987
MD5 72c5691840c8bb52d6de43773e839902
SHA1 90ba1c10d9ddfb4b4767b7c280a9b7c370c93490
SHA512 81d9ab47f77c0262ec52e1bcb89334bdf24a4b0881cde1f1218c329ab77b9e653c75daa24b850279987ee67d6433f61b0af4fd420ef00cc8c2bf8e187b868448
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fae279721a382a5aea618ea488cece3c2cbbcd2f5fec76ca1c22ca65218867f8
MD5 3e5bd33a4263a73a8d6a21bdfb677c60
SHA1 8a5f8ec4adb12bf94c8d18bbfdee2f8e8ece50c8
SHA512 2da135bd3c6e44dc60d554afecbd8ed7bcf7fbe35ff8696332af80dc37f5b7d7f72cc631fe5cef43e75958dff6b9d44b21f52a2ed904bbb5fcf9b77d816f5e4f
SSDEEP 96:n6kro15Cga9IQwpvWMoiVmdeHpCr4bzUWQyV+VD7ziEwb:n6kk/RaCQGWMXpPbzrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 275889dd7b6ccfd8d303a5243148cc9c812eddf02478f20197196d1017d06588
MD5 a0be0081bbbf47cea9492b00c490af20
SHA1 57d0c6bae7eed893cf4a0bead28b1d9c95aa2dbf
SHA512 d9a32ff52c18e50daab766d78538a9a0902a70d78c3373370eb3e1d9e7745a6a814449e38e0539131e8f9e9640074701d0f11fd6fbf9bfa0b02478acb9f52f53
SSDEEP 96:n6kCo15aga9IQwpvWMoiVmdeHpCr4bzUWQyV+VD7AiEwb:n6kL/JaCQGWMXpPbzrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9de231aab92da93aa565bf1f475c7d9e37549c27aa4964ff236ad13bb8cd6a24
MD5 2f307fc850192e26402972891f09b63b
SHA1 56d0cb8ef85cde0cae7951885a9f3b81a572dfc2
SHA512 f5fea8b69e4bc898008bfc635732d77cfc7b012367eecb4c413998728aaddb10dbb8d25e60881ef538c2d86cb204adc0a06104f251dede6e1c9b05f54529fb83
SSDEEP 96:n6kCo1paga9IQwpvWMoiVmdeHpCr4bzUWQyV+VD7AiEwb:n6kLzJaCQGWMXpPbzrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8bf6f331bb74e18325fa4e79eb7e112372b8dde5430381762614a013955fd5e8
MD5 ed5f7c80a8892a055c95f768267773e6
SHA1 77abc4d4dd417af2e982bbf3c4a263bfbd93b6fc
SHA512 c2fda2175f6c96d18ad00e6ec81bf73d45253a88965006268b14330682faf8aa2e80c38f2b98aeb136e0fe0f1b722fb481ce61c84beb3294a98cc93d70317a2e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDkye2RU7jf7ZI3z2OMDCR+:A9iIxuERzA83h09RZxYDkMyzZIaOMWR+
MD5 SHA1 SHA512 SSDEEP

Submit Download