902b88b26377cdd73d2eb7b5b457bb972cb9ff245fa6b06f040adabe30e1a762

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91d0c499ea43f2f5c69d01cbf5f97285_JaffaCakes118.html
Size 31KB
Sample240603-pvmtfaga67
SHA256 902b88b26377cdd73d2eb7b5b457bb972cb9ff245fa6b06f040adabe30e1a762
MD5 91d0c499ea43f2f5c69d01cbf5f97285
SHA1 247bde8ad33bf89123caf03881701cc1653882f4
SHA512 38983fde9e33f477137019fd20d63f3f32d5b363592bd6b49401c81bc6d91fc161ef8379bcab7e8467da3c6a4ee494208169053f87c127d3b9505a7b5be52c2d
SSDEEP 768:A+E3W1aFMmRiimM1lgs+reBoXPUK/aTTXJopuct1KK:A+Em1aFMmRiW1aruoXL/aTTXJopucv
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4608	msedge.exe
4608	msedge.exe
4592	identity_helper.exe
4592	identity_helper.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4316	4608	msedge.exe	84
PID 4608 wrote to memory of 4316	4608	msedge.exe	84
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4704	4608	msedge.exe	85
PID 4608 wrote to memory of 4108	4608	msedge.exe	86
PID 4608 wrote to memory of 4108	4608	msedge.exe	86
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87
PID 4608 wrote to memory of 4740	4608	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91d0c499ea43f2f5c69d01cbf5f97285_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8cff46f8,0x7ffd8cff4708,0x7ffd8cff4718
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6284695559541851030,9730020984464276019,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 630eaf282812c91c926b0599c4f6e2e662b9c89d5f30cde605d20e08963e66bd
MD5 42f676920e2bff2531172a8260c1efba
SHA1 68375cda304ea66bcc758bff429f3c600fbdf5df
SHA512 5579b5558765011617dbfc6dcb5072a4b41ff0c79ae709be978d762af39b01f7203b58cf5996c9c53b75d08483defa8da0d5694208c26cd501842f7d224cba97
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 b857de7a1d98ebc8ddc5f441367cebaf48c881063ef2aa25f2b37e04c6100922
MD5 83f2d6503db4518cd5d2c2323a221e44
SHA1 516242d37061f9f43ae9a87f8ef2585560718509
SHA512 4242f3a33f656b614d8081edc683bdeaf8c1570c2acf9d3980d9c262e5f4d8753c851213d292282d424d833ef8ad4ebc7c00e31e474e8b9bd85049a2f1a94f6b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 987B
SHA256 e9a2d6c04b5e997cb5e0c5c0dbc8c23d5a9dbe546d3697954a1dd48bed17d062
MD5 e4013829c1535e4cb8f087002bf8656e
SHA1 4cb803255c56e59d924f36fb264883bdba06a50e
SHA512 e3c09c01fb1a1cee494eebf8d9e53d591910defef484e4bfae3bc8530ae4f4b5f5113de4ef5b05d119c29bff67e57c2b4a8ed7a87200173c1edecd445fdc5ec6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 35dc0ed0e701773092d530b799d91f5728f4b5207d77213d78c48bd3bba23754
MD5 eacadf334530d1a95fcd2339e875f190
SHA1 a479c48c97bff1e4d9951a12a96bc0201db78d9a
SHA512 7ae069137dd834d9621006413f2731579638518a6b83962f9957b0d1aa3a9ae9b889c85fdeb2cd2ea9d5de161f8d66ba4e59a2f8b4ec9bac13fca1ceaffaa506
SSDEEP 96:n8ksy19Gga9IQwpvWMoiVmdebNjgLNav2pC13bxwUWQyV+VD7AiEwb:n8kjTVaCQGWMLNjgxav2pGbyrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 da76304739b2a085ce2970714bb453b1f8b4c4d7297ed18e247ae72c90e0feb1
MD5 6f15ca892b1cb2ee841b3a79832b704f
SHA1 91c7d8424691d2c10eb0a467adaadbb1c81cfba3
SHA512 4063b64b0f5ac3c3b3e04061f3907c94609b28f4f00ab5e6009404a9b851b86cc386bd004014abfbbef28422bcf7e740ba561d7383ca7d6cca1d1cce603cd7ee
SSDEEP 96:n8kCy1VWga9IQwpvWMoiVmdeHpCr3bxwUWQyV+VD7ziEwb:n8kFfFaCQGWMXp4byrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bca802215ed037cb7fe2bb76967d2fc3345eb1d9f216fedf5349e8b48b35d22b
MD5 028ec3c60b8d5e870f2d478aa9e60f80
SHA1 abeddfad9953c8fcac59f0e22162de02cf564b64
SHA512 5a1e80f92d575b4876f6f98aa8557d81c65e13cda6e70338645a5c4fe0a7b021e3e5f210b82dc6213e04da738db23682d4b745d469ee9cd21ab9cf784aa912da
SSDEEP 96:n8k5y1VGga9IQwpvWMoiVmdebNjgLNav2pCr3bxwUWQyV+VD7AiEwb:n8kIfVaCQGWMLNjgxav2p4byrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 aa093a837caa4a699eb8b0881d46dcf833cf155c5e95204ba147448c5cd3ea56
MD5 e7be638943f77d14ac09941acc5acb8b
SHA1 d39e1f81747b8b7b390c65b36c7fc65c8ba12d94
SHA512 60701b9f8b3cb8db2714bba21edadf0eccd5e8e8e548cee695d2a383317a785317a2dd0f103d8b5078f336cacbf2685d7af0aa2be50be5f2133be735658de2f8
SSDEEP 96:n8ksy1VGga9IQwpvWMoiVmdebNjgLNav2pCr3bxwUWQyV+VD7AiEwb:n8kjfVaCQGWMLNjgxav2p4byrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e8b3fb88f9cdbe078634ad970a68674146cffc2151d8ee2f45afb56e5158bf41
MD5 8101afffb54d696ee7ce8cd1fc025639
SHA1 6c53e0e446e6ccfec658ed2f0afb0be2e39515d0
SHA512 4ddbc0690731173acf89b0ff24545d9493bd41e8a46bf3c61df7c1e8fc7b4c6a967b10f4e026e18b3b109d0cc13a30d7392394383d5b0a88fa8017c445048353
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0ydkme2RURcjf7ZH3z2OMU:A9iIxuERzA83h09RZxYvkouozZHaOMWT
MD5 SHA1 SHA512 SSDEEP

Submit Download