4349dc498759207b570b3462d2647285feaabf252cc3fd0dc7f19830c159b9e7

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
919fb31e050e796c0d737dd7becc90f3_JaffaCakes118.html
Size 337KB
Sample240603-nmqppaeb95
SHA256 4349dc498759207b570b3462d2647285feaabf252cc3fd0dc7f19830c159b9e7
MD5 919fb31e050e796c0d737dd7becc90f3
SHA1 7691c526a77a636ac3ca37bb0c0dcdb11dc18e6c
SHA512 5447176a62e23545002dca6bd96880f043a9cca1d12bf2ebde003545184e3dba199c05924970bee731adf6b7ac3f755cc23364f2d63a9567a32e2faaea54167c
SSDEEP 1536:zcQ0fbOr7f7MBjxj1KEFmJV5UPbvUuHgB/dFE4bv7ntDhz2yzLDF3V:zB4jxj1KEFmJoPbvFHq/Lfv7ntUcH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
4712	msedge.exe
4712	msedge.exe
3656	identity_helper.exe
3656	identity_helper.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe
5184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 1124	4712	msedge.exe	83
PID 4712 wrote to memory of 1124	4712	msedge.exe	83
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5056	4712	msedge.exe	84
PID 4712 wrote to memory of 5060	4712	msedge.exe	85
PID 4712 wrote to memory of 5060	4712	msedge.exe	85
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86
PID 4712 wrote to memory of 4628	4712	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\919fb31e050e796c0d737dd7becc90f3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4180187674778197989,12999538011245447834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 97a9514eea0d4f1f9c5c8e9721c56ebc363f32fdc9d34b8c988440ee1cd102c0
MD5 dd2c7cc73c22303a40469a03711a9e1c
SHA1 5db99b065e687a80647f3425ef717b9a8e950be4
SHA512 2b2441a16376d787bf28ce0995af88a6fdf9c122f5c2ef58a8b0b92e61dae625671dc7da1f9cd7a5a407ebe3b1018d78a90a69de66d75344f0189261add88fc2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 c7f74fad900b26188bbc6ebc1c3f54b23ae7bebb4a7cec83e3795cc64c75074f
MD5 57201be320cb029dac1059596f7e01fc
SHA1 3f5e6b6ed650fd58e296a491095badd568bbc2a7
SHA512 747099531342fd97962d43fc6a2aa18fc64a5fe1f1e7a4941f62a0a254d2667963e27e558362513e7d8671bab9c511f604f6f8051c81ef30e0ba64a5b3461492
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a72a3d864ad2a6e4d5d5e52b1d01dee213ef01f8e9712dde0072219bce9f0fec
MD5 c95c9600beeee8b1523b52bc347fba7c
SHA1 1dfe4ed421ef0502249afd97c79776d90b4803b4
SHA512 bb40c1fcfa65cfd78934fd166acea8f0dcaac9faeea98c2d07ca0deacf8217a54af869dedd88a13be4938d4fd19c8cad52646de7f4994ad9fe6a69b3a56f1dd0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2fb331ccce06646fc11981346267374e0e85bf12706456ce019992906a20398e
MD5 9dd60433b27e50dfa4bd5743ae0cf45c
SHA1 f14f08ddb135ad0a0d6cdfbc6b88b18a498443c4
SHA512 79800877b5ab013de43a170a8882c002d76ac462c5bf1a39af731ee68822c6cd5981130eee5427682ca3bebf0f6ed72844ed02792abf99d0d03d551ab84e9aba
SSDEEP 96:nbfkWz15dt1wpvWMoiVmdehGRQ2BrzMUWQyV+VDCAiEwb:nbfkwv1GWMxGRQ26rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c7f18c37f4d5e6d81be6cf2020aa1493122970dc1250fd7bf6ab8bd7aa2dd874
MD5 41b3f2437c7727ea81d4017c183933f4
SHA1 4e4bb0c62f282b13aa308e91431a485853485e8f
SHA512 77dda8061e0bc83ddaee881c1dc32e54e70ff1e656cf8f6866578e9426f4e23a9f877363165de846ce691bc69c9d13648a7270aa5e6cabd4000e2ab55bc18f0a
SSDEEP 96:nbfkfz15dt1wpvWMoiVmdeHBrzMUWQyV+VDCziEwb:nbfkrv1GWMX6ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7c3379c53905b7f7f403268f754212a2b3a8d5289193d8e7e9170633c089a1e7
MD5 5664e8b8c308c339bbe488be296640a4
SHA1 516105f165f9708de348aa491ac7f517d9bb41eb
SHA512 fd20cc5c7064b4175b5f80525a655fa991a3d7d50a306320deec8418fe67309e33a11303b747ad2b86ef5c0356532606655e133375f8f1e55e29f77fd459f5e6
SSDEEP 96:nbfk6z15dtFwpvWMoiVmdehkyRmNzvE6YErHQ2BrzMUWQyV+VD7AiEwb:nbfkcvFGWMxkyUNzM6YErHQ26rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a25bf3b3ee48eab2e3c0856c9b45cd1c88f4a16dd1826c25ff0fad42825c8377
MD5 f08ccd8f9f8cc879a427c2690ac40dcf
SHA1 c821f01904990ef9b2a3f9c2f58cd1de5a0e7d23
SHA512 b2e248bfb87d01ae6fe0ea66c49200b4ab95affceed3b0b5796f1f3d3bf6ebf52a7ab7e1e5862e0ff8bb3038edf7d56a43eee1c49fb80c2dae53793e48cb8754
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEHte2RUmMj2Ml3z2OMDCRs:A9iIxuERzA83h09RZxYEHpUyMlaOMWRs
MD5 SHA1 SHA512 SSDEEP

Submit Download