92f79a594451288c79b766d23992dc6e4827a8b52fc62eb18176334676be29c8

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a76fac8d09bb8133ce55e4faab44c390_JaffaCakes118.html
Size 68KB
Sample240614-bc29hsydrc
SHA256 92f79a594451288c79b766d23992dc6e4827a8b52fc62eb18176334676be29c8
MD5 a76fac8d09bb8133ce55e4faab44c390
SHA1 a3eaafd2950c28ec28831fa328588ab613b65547
SHA512 de6aaf123012b502d05b4cd74e1da5be0b98107a06ed663b28bda6c5d0fee82e4f9ed20df94ce74c37f91ac56de62a410c3df7162dd643ba6125d1009ad9a0ef
SSDEEP 1536:p9wUjwpD3OKG6zFDDVuAcqI3GOqxp83DWIau3qiXtYVIShtLSAIZC/pVQxMS:5jwpD3OGhDDVBcqI3Nqxp83DWIau3qib
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2196	msedge.exe
2196	msedge.exe
4580	identity_helper.exe
4580	identity_helper.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4072	2196	msedge.exe	81
PID 2196 wrote to memory of 4072	2196	msedge.exe	81
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2868	2196	msedge.exe	82
PID 2196 wrote to memory of 2956	2196	msedge.exe	83
PID 2196 wrote to memory of 2956	2196	msedge.exe	83
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84
PID 2196 wrote to memory of 1180	2196	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a76fac8d09bb8133ce55e4faab44c390_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf84646f8,0x7ffdf8464708,0x7ffdf8464718
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,3281283810084859340,13989768200431529038,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5576 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 b762d6526ed43355d130ca8708fe09248074cb30a34de74a366dc09bb6f1aa95
MD5 572269fbf3c0f1d8f81a44a583c58006
SHA1 d97dd7e23cd3719ae30d47cdfcd190b2c655b9a2
SHA512 abb201d64eeec433ba56b615befc526096591b8f227c5a54190f69b0a1add73d4ff9a35ed40cbbf3ecbd312c20be1744e864db1eac91f1f17cbdff10aec23495
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 fa2c9d436681458dbe901dff463d940c2d34c3e5965a4b132cadd408f63f0fe0
MD5 6468aab218fc2c392165b594e11ce700
SHA1 fefcad6dc771efc93397ebe807208f68756d651b
SHA512 26a50d5a72f478e4c69e7fe1517dfb2c9c9ea2783dbde9f390c9918274b8455e2bb04bb91bd953396102115302808c3f01a9a3cf6cc498f5e563424fa9ffb7af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 84486490b7c86b0bb70ca56c2e3023fac936ea8fc8adc0843597d8bee541ae95
MD5 1f46df4a02c585cce1fa535f58ebe732
SHA1 2fffe32399a64fe98dd768ccd5f45e4bdd2c2838
SHA512 2a7ce70264169120f5a50b1cbb5ff264bb582f8fb31cfa62dd6c586b1e698627832e6cc869e753af01027d53adfc820601e2bf0338738c5c2471268b8a3ff228
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7b105d11e6f6e75af7ae413e040c0c8535bdfd81b5196eb5edbc5f60aca557a2
MD5 c0cbd8dd70d140345ff3c7b8ecc7145a
SHA1 721194c6c4dfa86615a7ef731e3bfefea5a20f4b
SHA512 976d5e7ed70ef43939688378078d4e088394ac20a51a202e0503ae4554de07ea71e4c21afe7d528482c0d3e4d83d9fe585fe7d42f6397afea9c4ca4d28fc85ad
SSDEEP 96:nVkfoxm/DQYmqF1QamwpvWMoiVmdeH1DScUWQyV+VDCziEwb:nVkhIqCamGWMX0cro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7e4a73101db69fd3930be1cb52e30c938b6fd3041c8893e450b8ec684aeca146
MD5 8115f359cad8e57349ab67abb3309137
SHA1 5a0e5521b1d84c3cf67b4ee943d5b17ca739c081
SHA512 a33957427096cb5e36028666b303f4b5e40234c9fc7ef1016bfb8cdfae6db7d90c7c13a5277e6755c57ec442992ea125b05159b62d18e447148c5d389c3485ca
SSDEEP 96:nVkfoxm/DnmqF1QnmwpvWMoiVmdegvtjDe3621DScUWQyV+VDCAiEwb:nVkh6qCnmGWMwvtjDe3620crV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 5070968868b8cbfa7a8b8203412c450a99acd3ba82d82e435de25ea896a29281
MD5 cc468d36c4484685d2c66bd7f3e245d6
SHA1 2038e03189799d516a032bb796d7227146563a2a
SHA512 558b07db276c39d5107353a2d9e46ca344159d46c3f25e12300580934e424888cb53ab463ad9a05b247391c3fc5f257b6e975be6908b7d57b713f3317b5d2493
SSDEEP 96:nVkfoxm/DnmqF1QnmwpvWMoiVmdegvtjDe3621ITScUWQyV+VD7AiEwb:nVkhCqCnmGWMwvtjDe362SWcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7bd849a2f437916afc05879331eae738029e0fa5152c913162a60e6053fe2117
MD5 8e9a5196fd93257cbbdfba96d237fef4
SHA1 02cff2b1500614ed8ee97a82d4f09b7bd7f218d0
SHA512 9394d1e6a68140f66943385624f7596c6373b89674fd5c2568c269b3493a488325b2088d5c8195732db665bd3c9cfe279fb256564dc8aefd7e5d859a6a7c995f
SSDEEP 96:nVkfoxm/DnmqF1knmwpvWMoiVmdegvtjDe3621ITScUWQyV+VD7AiEwb:nVkhCqCnmGWMwvtjDe362SWcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a5900ffa242babdfe07ce3f1abcc1f935832008a2596cd6506fe99be43679817
MD5 dfd1fdfbfaac4b81342f38d08f44e342
SHA1 3b0b5a73a70333c91d34e2c1861743f79ba2742d
SHA512 eb2558fbce1578332a53a21d837f4446b150937922c7c2dd5ede374708cc4898e22a66eadb37875e15478746dcd3e48ff9c7b89975eaf1878104b7dcbc7b2986
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupabe2RUwSRsf3z2OMDCRHqY:A9iIxuERzA83h09RZxYKQGfaOMWRHqlq
MD5 SHA1 SHA512 SSDEEP

Submit Download