4cccb8ff1dba698e221edf3da021465611cacba87d94f3af4c50630341ce569c

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5fc0fa1c366ada2c8ebbe4082fb910b_JaffaCakes118.html
Size 42KB
Sample240613-rmrtjasdpa
SHA256 4cccb8ff1dba698e221edf3da021465611cacba87d94f3af4c50630341ce569c
MD5 a5fc0fa1c366ada2c8ebbe4082fb910b
SHA1 02d4d77b49401a5e023f92be47f37618fe9bdcf1
SHA512 4c1bcce6cbfef4dd93f48d0551f8a9d0f2916108948d33354a52da0cea2594064d30bb22a4f1080b94b553e085bfa94be064a75e75be0add251490cc82e64f37
SSDEEP 768:Z9ozhsnxALoG7uj2dgDadvRN/3DXuLAvlvqaixTJXCHOdtPaKXOvupzoOBToKAXP:TjW/uyckOBUKAX8HIPJci
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe
4088	msedge.exe
4088	msedge.exe
3612	identity_helper.exe
3612	identity_helper.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4288	4088	msedge.exe	83
PID 4088 wrote to memory of 4288	4088	msedge.exe	83
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 2036	4088	msedge.exe	84
PID 4088 wrote to memory of 1544	4088	msedge.exe	85
PID 4088 wrote to memory of 1544	4088	msedge.exe	85
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86
PID 4088 wrote to memory of 4436	4088	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5fc0fa1c366ada2c8ebbe4082fb910b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81a3346f8,0x7ff81a334708,0x7ff81a334718
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,18368805861366597848,11029862797141965652,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 5d8ce436c30eccaf36a35002819daa2095fc28c5a2377bf2ec7ebe13efbc70ee
MD5 91b23d6872803e55ab5fc6afd01b815d
SHA1 2fee113a3daac30dd0bc2a90ff0a1217aaf60884
SHA512 4e62afb6b9ed7744c15911dbc1d12a7e88a8fa5fc1e6cdb77928b963edc05b204af040eebc8630d823d0aa536b215ea76900f8308fa57accfe6c8640c75e5ee2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 62c3b4cde5faed0a5cb690daa7f951704b3c9afa7724a5297128c0b6e5b5b01d
MD5 1990ad2547d1dbfbb037b86cdc024dc1
SHA1 37ca49bf79ccc6f77e385eaaa9b0a5c7cf5f5fa1
SHA512 d21ac30e121785176bb495e607cf8ceca658e78262a48094a7407aa4f29aa1ef4e857ab85a4ff59397462c1a3aa164c9a24cfbcabe45d763bd9122adbd107830
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 4f0c86aaa3ffd391516d4d9821e74c3cde6d9ee3bf0bcff12995256e0b0111be
MD5 2e3e3b0d85850625896d278b0d71707b
SHA1 1410a3e3d23df77e0be4d04927516604abe730e6
SHA512 f58e782d819fb41aba0226495ba4242cb246e25bcfa84ed5224d454f83fd950b17050a12046c5f7fd7dd4eec70ef3f7d538ee5a77c98e2cb77a23fcc796722fc
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7d214bcab6c9c56690a408a3762dde4ac78394a3c8b0690b4482c215ce347f01
MD5 e7c0fecb8b3a90686033964b5b48e742
SHA1 9933ba3025ab570fe065c2ac2e93f618538c6bd6
SHA512 9993e04bcbb7fbe29bdac9d03984bcbb7b2b6b559eae38abf566329c3a311da42675ffe339630c0a27f87bfe3a271a57eeeeaa688f9f9bedced2f50ca3885ea3
SSDEEP 96:nckBoxm/DQYmqM110/wpvWMoiVmdeH2WffUWQyV+VDCziEwb:nckrIL1e/GWMXPro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8ab065c719d0d696594ae01072ad68862430afc40254231d9339364810a47faf
MD5 577eef6866c39c80b395a36d98fd9e0d
SHA1 8ca41741206b0fdbfa999feccfb6c6e5fd6a2aff
SHA512 f741712bb0d7286491cad19211ae2407ad22803e65d44dc2ead7198b904aea8d23e8be3f1245cc0b0a4e163490cd834998e665ce4d6a7f7293acdc71c9df6ae9
SSDEEP 96:nckBoxm/DnmqM11QMwpvWMoiVmdedLbm3XvYXLP22WHfUWQyV+VD7AiEwb:nckr6L1mMGWMNLbm3fY7P2Xrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b26dc1717566b7795eba3e2de356f194bf86fc706ca54fee159c7382dafc11fb
MD5 5c83105450b615e250cb868a61ad7878
SHA1 4343a643ec61a5011a42c23bc494a90bb34a47eb
SHA512 4a09d0449845b6a0082c9b55f62101a3a2354fa5893e08e17052f1fd7b7a1ce4ef7360ceef1fc08efb4d454c4caa9ce526a39b4d445f87bf87ca9963b705ebce
SSDEEP 96:nckBoxm/DnmqM110MwpvWMoiVmdedLbm3XvYXLP22WffUWQyV+VD7AiEwb:nckr6L1eMGWMNLbm3fY7P2Prg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3b4bc08b359c2b16289a934a09ba77b566eefc903d625e3f74bee815984b0768
MD5 0a8bca482f8fa3c065c8a59434293879
SHA1 1f37c20fac9f7f74399f2fcf42e87a4f44c7c268
SHA512 1fd3261cf789febb407ceede53e643197564f68ec5be753b792302700807f4c6c9c229c80fdbc6b4078580d1812dbf740225138c4968edafa05f146416418c64
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupnHfSe2RUJh/c3z2OMDCRHm:A9iIxuERzA83h09RZxYHUmcaOMWRHql7
MD5 SHA1 SHA512 SSDEEP

Submit Download