2fc0ab92c98c879950dd78c89bcc05dd5786653440ee9120290221152944e28e

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fe90d90a6d8289e00c4c53f30b462a7_JaffaCakes118.html
Size 61KB
Sample240603-afpbdscb4t
SHA256 2fc0ab92c98c879950dd78c89bcc05dd5786653440ee9120290221152944e28e
MD5 8fe90d90a6d8289e00c4c53f30b462a7
SHA1 bcc207946e5db1a7750200cda8cc0cf90c113b0b
SHA512 e8062d4a8e98b84dd6a03821c85970a6595e95fbe5904b22ebb1d8b8e9e814dd5a8f3528fd99460da1a96726d280647dde5386e9205227d2881d1d2dbeb9a514
SSDEEP 768:m18AmX1gpjnYuqOv3bZjuseTkgtyve9sDbRFvnW2gjv4C/Fy2Sl8g/:V1gpjntqSju7kxe9mHraxFI/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe
3960	msedge.exe
3960	msedge.exe
4616	identity_helper.exe
4616	identity_helper.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe
3960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 1964	3960	msedge.exe	85
PID 3960 wrote to memory of 1964	3960	msedge.exe	85
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 3932	3960	msedge.exe	86
PID 3960 wrote to memory of 2068	3960	msedge.exe	87
PID 3960 wrote to memory of 2068	3960	msedge.exe	87
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88
PID 3960 wrote to memory of 1948	3960	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fe90d90a6d8289e00c4c53f30b462a7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff956ee46f8,0x7ff956ee4708,0x7ff956ee4718
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2073408503949578473,5815882719557183634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 44KB
SHA256 6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce
MD5 23536ccfe05b737ae639fe63ee4cc435
SHA1 6d2e9822835dc3e6117a4d2addfc8f241fbdbc82
SHA512 f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d
SSDEEP 768:feIhQcf4fkrTpidkiSOT+S2k9j3ulT+qZcOkgaONCHLex1RiZW+s9Ux9J6:feIhPfkgFiiPk9j+EM5XCHLex1Rp/UxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 1f551740058f712efcc81ce17f2ffb4368da62c3f3a86c413291a0bc641b28db
MD5 a245b59bd6f7e888b8959d191d01f20a
SHA1 a579d7ad26ddd6780b42fbe49bf6f205ffa32f45
SHA512 06b00b232023fdb4712add8cc60ae7ad28d29c9e833a62c8bc0e9aa87841d593ca9bb0398e39ca1ba9b5de3a9e888ba861ce34b92f6e187d7187bccbe5d8d2f7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 23e42ef8b85fa91e788044e9379f39e085f07ada875c3c811a5f83d1551da085
MD5 1cbdc7931451fb429eae2c7dcd59a234
SHA1 3507682ca6c5a7572bfd18bcf1bba91e521e0359
SHA512 10eaf85aff30085134ea14a2ca5bc4e5c8c578a40daf7b117ce6b3e65ed3e11a37d493e0371972c78065bbe43350d55e9d75dc5b3fd08141ebed083237461cc2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 56505f08004d441a7ea003191ecf0b4e08f3abb8937d9bb17cf462b809eb6a59
MD5 f9cea964018914abc67ac7db72eb53e7
SHA1 6b39c6ad3c716d04e5ccf465a480b6c3f2527c78
SHA512 f0cbd9b93c056d22272a27e3f3e3396321c9631cfe7bfdf3df56209b9a8bca18770e85a6108e0492db3433d16c5a2cbe1a5030f9e36bb8c4be9d6e913dea8f31
SSDEEP 96:n+ku591pQjuwpvWMoiVmdeCzYZyua2vSStUWQyV+VDCAiEwb:n+ko9bQjuGWMSzYZyua2nrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0e3d8aeab22a26b8d79f9afe962ca35af1b924fa445e7129367d9ac17beb28e5
MD5 bd2a16a9e72e72f8492222a12eb2c5f4
SHA1 f27141235c2bbde2ae0196b44252bd26fd7f966c
SHA512 10dc9a2313a2e040f57cdc45b660557c8f973b1f9ba2affdb7cce75f61dc7ff5b70757d9a8530aa48ee41c2121cc6a0b184f6f80bc03e655f2073936c762ba73
SSDEEP 96:n+k3591pAjuwpvWMoiVmdeHvSStUWQyV+VDCziEwb:n+kJ9bAjuGWMXnro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e7ec477330a11b38923dddc2aa5db7a8e5e537520418b7446db320b30ff44078
MD5 f728df2735e2561dc139817f76a5c3e1
SHA1 e8795f23a420c1e832c994a515c1c7b3f15b507d
SHA512 08c9e4f4bce8f37d535825365fcebfb8187f1073582b3ac67a0a48c00aba66c356b2720a044e9e3f64f1e2d54bf411538c2e25c6ff216b195c1b06b374ea4319
SSDEEP 96:n+ky591pQjuwpvWMoiVmdeCzYZyua2vSStUWQyV+VD7AiEwb:n+ks9bQjuGWMSzYZyua2nrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 56ccd65229000c943290cca2fe3b17b5694827d001cbde5984e7bd6091b4b74e
MD5 1d6aff8e9688c6884355efcadf92d189
SHA1 bac124669722a23459c34cab204b66d8793a968e
SHA512 456036cb193df1a1ad518a747ae74f04f9efd427d16faeeda154675dedc52888c5cd43d160771d1218120c24f1b20907d6893b8a26851a667c8de09d10ad4943
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj1e2RUZRuuT3z2OMDCRHqL:A9iIxuERzA83h09RZxYjxfuTaOMWRHqL
MD5 SHA1 SHA512 SSDEEP

Submit Download