d4294b7266e16860c6814d90a0ff5da61f7a93f53206176c66d5db1f4dceba3c

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
82dcb18f1749a7ad1d18e863089a831e_JaffaCakes118.html
Size 37KB
Sample240530-dqr2tadd34
SHA256 d4294b7266e16860c6814d90a0ff5da61f7a93f53206176c66d5db1f4dceba3c
MD5 82dcb18f1749a7ad1d18e863089a831e
SHA1 923653c2273034ad01610cd942bb6cd4297e8b3c
SHA512 ef220f18cfb1bdd6144788843721a6490b6d044494a4bcdfdf71e80ae72ebfa10e6dbd73f57a95a15bb6fb7616438db8e3728617d0330a15315f2ce42d0721cb
SSDEEP 384:MjvHwduTvmBxnx/RLAUmcoXWV+PzCsBSGXNEu0:MjquTv2nxZLdViWIVB/XNEB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4372	msedge.exe
4372	msedge.exe
424	identity_helper.exe
424	identity_helper.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 3472	4372	msedge.exe	82
PID 4372 wrote to memory of 3472	4372	msedge.exe	82
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4492	4372	msedge.exe	83
PID 4372 wrote to memory of 4868	4372	msedge.exe	84
PID 4372 wrote to memory of 4868	4372	msedge.exe	84
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85
PID 4372 wrote to memory of 1676	4372	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82dcb18f1749a7ad1d18e863089a831e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f4718
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,18174042034004327462,7357481575076525198,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 9dd5ad6b70e74441c047efe288834fc6fd4c6f15b04b69f1445c6330b6432484
MD5 bcbc1dcdd21a43fd63b0cadb01ae1a95
SHA1 9b30f7039da6a17a82c0b17770a57f0333861954
SHA512 a8aa44267a1b42931f15ee06d3a403d7b3c678ca0313c91f7ee95ca89a4b636504586ce687d6521cd5aadd97079d8c1138e8cf8d6a549aac95d56a8fac785d40
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 f6c051e994a3c7be3c03bcd6c512d8612254547651fda8837223dbcf449491b6
MD5 c9ad4f9a8f2ab4497e7d26ed7545e3de
SHA1 05d251a107d668700c235f06c10de7e883480995
SHA512 e1b9cbabcb97b88c6662177e06042253fb8b3f8291975240ca4779c50dc76b7e4f96f2aedbd19250663b919605a5f9f58573c15209bac44f735bac66eb1bd630
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 d3091f71c3c05b8871c63446215562158fb8c44d7605700443c901fc54bf5c35
MD5 83c9e53627e079c6b9fb5e3fab96944b
SHA1 a5096307565febb0fb3976978c0d8de96eacbf15
SHA512 41eabd6e802a67c5747c78a664a1e953665e4bc1cb4996e48ebea3b1a7e01ff1f94ef3a7cc521c599ae95fb586690a0e89f470542424c878d8c8155c9bd97c3a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 eba41de0c6957f117d23b39426ce6e3408a72a97e289e635773843766eb90f31
MD5 6b1ab704ba09d4a72546f945c52a34eb
SHA1 0f84e8131f0018f78af7536d17ff3783890d6ffa
SHA512 f2bd65a8839c0efc796478fd41b86d3c2ec664bb363eac3e906ad1967a702666c9435f633a2dbbadca5b439cac72cac91cdd032eebc10e6b8a6cfe1a30def9e7
SSDEEP 96:nCkR591MBwpvWMoiVmdeHBrzWiJjUWQyV+VDCziEwb:nCkhuBGWMXsiFro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 bea0280d62d988da8c7e7f23892255abbfaba94a3954594181fa6f319d037a14
MD5 7369cd5a4a160c75cc834e378194974a
SHA1 5d277a635b75d6831c0e762a53da7286ca93e338
SHA512 0143e16ae7063a1bab60b6a1cb52d87372bda0dcb6e8065b7ea61d50089aa81c193b5c4efad2a8f24fa0d227f1745449c66c02384d779e8beea5b8cda4d1e463
SSDEEP 96:nCk8591M0wpvWMoiVmdegNVcR9zEpErjSVc2BrzWiJjUWQyV+VD7AiEwb:nCkeu0GWMqeTYpErjSVc2siFrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e298c140d5f90b70438e5eafa1f5660db4019d0f578b86738b9d21d6c430db74
MD5 e962d283127037856d08c373b484947e
SHA1 151277da93c8e09a0fddc6a7dc90f4034504969b
SHA512 54ff1d44247ded65f5f3423a8c1ebf95c6f9fc6ef145fd23e6876bd0c541d563e6e5608ac151e1f17e09ddff268d24976f6c5402c6290ce0edb8789f5f88e6a3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQHne2RUEn/Mj2mU3z2OMDB:A9iIxuERzA83h09RZxYQHPhnEyRaOMWc
MD5 SHA1 SHA512 SSDEEP

Submit Download