c0f878a3489b8cf6b69f9f0b16e9d90aa74a643807f7c57ca9de86b351031cf4

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fa673854cbd5c39dcddff8bc0f2a265_JaffaCakes118.html
Size 175KB
Sample240602-2dg8vaad55
SHA256 c0f878a3489b8cf6b69f9f0b16e9d90aa74a643807f7c57ca9de86b351031cf4
MD5 8fa673854cbd5c39dcddff8bc0f2a265
SHA1 c463641d3ca26f0dbc63f5b17eb755be1f78f9e2
SHA512 dc82cc5b00602d19a8da213bd860f89b6ad3143ab09390dd210d88e898594e01c25a3a8eeb3cbdbf5fba1f39bd49ea5c943917d648a406974ca93e1667efcf1b
SSDEEP 1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3JGNkFGYfBCJiZ++aeTH+WK/Lf1/hpnVSV:SHCT3J/FPBCJi9B
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
1124	msedge.exe
1124	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4140	1124	msedge.exe	83
PID 1124 wrote to memory of 4140	1124	msedge.exe	83
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 4932	1124	msedge.exe	84
PID 1124 wrote to memory of 3096	1124	msedge.exe	85
PID 1124 wrote to memory of 3096	1124	msedge.exe	85
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86
PID 1124 wrote to memory of 6128	1124	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fa673854cbd5c39dcddff8bc0f2a265_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3433024692388246894,12390319628883357517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 3fe58cff0ffd69d1b264217355e0e421a45d96d600ddcd7683ec08d001b49e93
MD5 a226829682f6f27a0b0b5f735a75b1c8
SHA1 a2b71806f3d45c510a7d95d7d968563859ca2096
SHA512 ca9fba0041ccd1ecfc29d869d738a8c4b75022fd543dbb184c302051de732a67de633fccd0f64a50bcd02911051daf599cc70390881e6830f2329566f6c4d217
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 8e0bc8348f35770ec0110bae2417f97efaee49ecb19be6a94c6d66415e2d66eb
MD5 9f170bf5d0dee13f92705fdd7f2c46f8
SHA1 fe34b27ff112d4195fdd3de5a768c1a938e7a488
SHA512 c9bec84e978e927953014d20acadbe8aa4b580891fb0467d5aa96bc4a7b88d6c9dcfb0f4018eb23a772fcabc793a780f5de61bdfbe677ac293fa2c2efe128b98
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 0be0d4b6bff86b4169455a31f836c2bfb6e1671ffad2527772e0f01accf97c12
MD5 0b1edcdc1593b9e0fd5e008b95dbd607
SHA1 c850833e3167c58e4b30e22b1b8d5bc9275640b1
SHA512 373055d27a2279305bc74190828b88b58ff4eb9ca4377a416b596baaf8bbfee3c595522cfef27b9a10a1decc8f1059ecc9cbad60206158ac8ae69efb0e67c829
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6501d5a25139d94d080d540f6119cf9da19a512f117942b8ec09c1855a9f0c8e
MD5 d2f9e80b8ce3503e7dc6dae677e869dc
SHA1 bf1886bcacd68801776341be48799e56bc035038
SHA512 f2e2f5780ad65c86b97a99943477e070626d84db963fa2011b1509ab594d6becdb9ad69af30090fd5fc5f69abb39d94c0a43a7eb050aa2e6a19b3dc991d989d1
SSDEEP 96:nJkfB1MI1wpvWMoiVmdeHBrznUWQyV+VDCziEwb:nJkpd1GWMXZro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 173c6a5755a9c93e3790a0af6981613dce676723beb57d48ab6a12ef2eeed09f
MD5 1b6030ff6d124518b865291fc20351fe
SHA1 e5acc0f0790aaba4f7b86c91f3c413a46c5e3d5b
SHA512 77faa6a8c9533048fad27a3a1fbc7acf385cfe9a69bcc69f077762ddfb4eeda15ff1a658cf2a247e8f0cfa08471d6ba3aeb3503dc12c62f078c2c6f5df533948
SSDEEP 96:nJkWB1MIowpvWMoiVmde+VERBzE9DgErOElgDt2BrznUWQyV+VD7AiEwb:nJkadoGWMOKbY9DgErOElgDt2Zrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8d07662ca936f96bc2f2cd16940e7fa8c0da29b4d15fc793916f46eb4714f277
MD5 29a866865f42628e45616bb9252947cb
SHA1 b18d2f2e532695fde6c765cfebfcfcae44269211
SHA512 19ea36af9375e9b81ab1eb6d8dcbc491874f5f03a5b6e0b8a22536706daaa102eb72cc6dbc787dabd9a74ceab1450b9bee68398627fd5409185da45280bc062e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyHUe2RUgMj2T3z2OMDCRH9:A9iIxuERzA83h09RZxYyHaeyTaOMWRH9
MD5 SHA1 SHA512 SSDEEP

Submit Download