bc45ddce3e65fa3f60cfbce57a9cb411d42ff1acca3a1fa8ff3b9dbe63d61591

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8467e31bcb3d3ef64128d70a875734d0_JaffaCakes118.html
Size 59KB
Sample240530-rdp9cacb83
SHA256 bc45ddce3e65fa3f60cfbce57a9cb411d42ff1acca3a1fa8ff3b9dbe63d61591
MD5 8467e31bcb3d3ef64128d70a875734d0
SHA1 13f9d05411251794704358e378a58c2f20d744dc
SHA512 acda5734ade9bfa188013f0576749d1c0e00b3143bdbecfd809d0e2c72d864b2c8275292c8e04f0932335cfa37597a5fe8a1adff6c73a4630e387cdcc3e5a103
SSDEEP 1536:NpTlkW+tgzR2+0eTIgXYc78wqiTFpuM15DR/PuWDGLzLLv:/blqeTIUZqG3b1qaeLLv
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
4356	msedge.exe
4356	msedge.exe
4308	identity_helper.exe
4308	identity_helper.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 3680	4356	msedge.exe	82
PID 4356 wrote to memory of 3680	4356	msedge.exe	82
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 2068	4356	msedge.exe	83
PID 4356 wrote to memory of 1176	4356	msedge.exe	84
PID 4356 wrote to memory of 1176	4356	msedge.exe	84
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85
PID 4356 wrote to memory of 2712	4356	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8467e31bcb3d3ef64128d70a875734d0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee01646f8,0x7ffee0164708,0x7ffee0164718
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3884 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12346637033974070264,1089525533836005960,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

59ec49d2-aaff-45bb-b577-8440e7570a26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59ec49d2-aaff-45bb-b577-8440e7570a26.tmp
Size 5KB
SHA256 8b06873c8a3ed7f52ebce518c9502382ca98199a88c95163c088ad9152071e23
MD5 0649c4f319697abf5560cd73e0fefb44
SHA1 def837869da8e9c38473526d66f018b584f1e5da
SHA512 57701efa76d68845872ba671ede251bbd1a07c967233a24da6303ceaef1d1e9c242d91694a594498b4a2ed6cc5b5d20745b7acffd70c1937ee69c1038bc12c05
SSDEEP 96:nKkRBgY13nEj0wpvWMoiVmdeHmQIuUWQyV+VDCziEwb:nKkL3hnEj0GWMXhro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 00a217e0b64792e6d1ab1baaad1e73d2c623fdb45c965e3f49937a33b057724a
MD5 04dab3bc32d1315be6d9ae6da40267cc
SHA1 4d7b486a0ba5750618cf2ee4c7ec87e5e3a7c355
SHA512 149c112db32012bbb25f4f9c630aa3c91154a81ce73ef681c9488cbd97e961086ebcfb0a8f1cbb982e0249344bc821c7d2d00180c75fecdcba211ccab050fa8d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 6f13c0d98ed3cff87fd735f2450ac29a4c91d91ad870ab5804de141b456bf592
MD5 bc0b6cc6bef9f33de6350d2d6c21aa96
SHA1 1ded12bdd1baf88950e7897ee8c92ddeca3efe6b
SHA512 ca88f3ddc874ce8767b166ba424c5034da4e9f5ca819117254e5973de2ddb083b21000f92d2423697c699bda6e97436c6ba86c9b9f8acbf7f1ea8b22cb49feb8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 fc7ce5182271e81cb6d563cca7d04afe67bc5e0e21d9729ea67d6cfdfdb5d003
MD5 2ca3cfd83ad5c32b606cc31aee327ad5
SHA1 66bd0901cff29fdd8fcc1bdc8e54a4484a8b58d8
SHA512 159e479d72fce4de665961d8668991d6ac5959da68b442731d9339bd0c942ed8ec336cff2d0bbd107867342a36181b4214cd9aec6524536d6fceda2ccec7e304
SSDEEP 96:nKk0BgY13nEj0wpvWMoiVmdexNpfPzx/2mQ6uUWQyV+VD7AiEwb:nKkw3hnEj0GWMBNpfPzx/2frg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0e0d2926851c6a6a7d61af15c054d5603349e729a244b1aca7b56458746d5fde
MD5 6d4e1ed07bad75eb87126acbdfc25ee7
SHA1 9e9c5a6a3d661b7f9a873812e573ffdde16134f2
SHA512 4d675d7f2c53cf30dec38c8291963c5c8e006d9e82fe378266f14e830ff4dc6c01ed238c7ff982610b22882efaf43a678505c73a5b67566003991fb58df8af6b
SSDEEP 96:nKk8BgY13nEj0wpvWMoiVmdexNpfPzx/2mQIuUWQyV+VDCAiEwb:nKko3hnEj0GWMBNpfPzx/2hrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 593ddb4501916399cbb85896000d8ff4a67d2ed145baa071cf44c65a3b5696eb
MD5 fc141a9299b74a45163b27bf487ed919
SHA1 e43b82bc1cfc84ca6e0f19e64a59138745c0e25d
SHA512 90508f9e60cb52b3ca37decfac93df46120b12337ff50d521231fba067d5c9621e8d09c1a73b4b7d0368c194deedd698d76a953732a164761849d4026aecf98e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCwe2RUeIKbVfYOxhZHnqTL:A9iIxuERzA83h09RZxYCu5pxTHqTMTZc
MD5 SHA1 SHA512 SSDEEP

Submit Download