42191716f0671cc9c0e42f3a22d34b00b0910ee8bfd60f24e86857044baf3291

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7a260c4134cad5506eb875bd916350e_JaffaCakes118.html
Size 69KB
Sample240614-cbjapavckp
SHA256 42191716f0671cc9c0e42f3a22d34b00b0910ee8bfd60f24e86857044baf3291
MD5 a7a260c4134cad5506eb875bd916350e
SHA1 84cdcbfe4e825f0a12439d34c3aff265ed7e1794
SHA512 b9fa9b9fdb01bea03ece1968181768e1153ea1a37c4c6454ddacabb5f982d4210f6f482ad80629ce7c58fc981f45f9b1d930eb7fa4ddea57301207f7b3804278
SSDEEP 1536:zwgr8VkeO3QGiyKyaj/KnrZoaKaS6cgRrqDpj5:TeO3QGiyKyajMtoa/kDpj5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
1812	msedge.exe
1812	msedge.exe
2956	identity_helper.exe
2956	identity_helper.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3324	1812	msedge.exe	82
PID 1812 wrote to memory of 3324	1812	msedge.exe	82
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 2484	1812	msedge.exe	83
PID 1812 wrote to memory of 3572	1812	msedge.exe	84
PID 1812 wrote to memory of 3572	1812	msedge.exe	84
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85
PID 1812 wrote to memory of 4440	1812	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a7a260c4134cad5506eb875bd916350e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffadd346f8,0x7fffadd34708,0x7fffadd34718
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15431430916888316502,17673888475713258485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b86cbd8f3f5252456c8b2e2f8d737480142731efff38bdf23ad589b0bb789855
MD5 f11a8801f8f25fff6e2972d57804b8fe
SHA1 5f03e30b82459cfef574daf93be76e28072fc3cc
SHA512 95a0edef26f391a692c5e8576da3c0d92d37bb2f628f30a29a73da0cc2f7d7ae8d61a582b95eb72309047f4c80713ae1d587a889ead09c1efcd08e432172ffaa
SSDEEP 96:n4kIX1N1wpvWMoiVmdeHBrzbQUWQyV+VDCziEwb:n4kCH1GWMX5Qro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8a06d546c3b5bd372bb94c55b5e6fc2979e53344488b71f9f289d3c19746631e
MD5 431a8f9ba5c7bd9d9f8d23d005d63fa0
SHA1 9ea31bcf18f0bca137557c8530ed9cb8cdad4e9f
SHA512 831af03e6717099b6d346128db1190649370ed5a98313ac5b53bc3980474bf3efcbcd203b89ef93da6c966709d804e696fc34166b5dc838f89c5281d53159574
SSDEEP 96:n4kGX1FQwpvWMoiVmdeYc0Kcrlc+7c+P0ct9Br1bQUWQyV+VD7AiEwb:n4kILQGWMoc0Kcrlc+7c+P0ct97Qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 95b4f219711dec45b48ace9e3dcdcd4e2015f481f0d3a333786e814b0b6bcb55
MD5 6f761124dbb391713737292b976f9cb3
SHA1 7285f4ed2c9e0ef402c4f4b77dfd4b89482f31a4
SHA512 0d51b74224c83040e6d119141fa4bfada6d93a2c0a08080fdc481c628be1288d183cbd7a295de40d79985b8f758f5bbcf884bedcb4a1ec0f9904d4e9c7170eef
SSDEEP 96:n4kGX1N1wpvWMoiVmder2BrzbQUWQyV+VDCAiEwb:n4kIH1GWM725QrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d99b566458f5fd4ad14ebf23b41cb650d1a57b89f638506c72ed41a720ecb2be
MD5 02951934cd90141ffdce9897fe9c7790
SHA1 de44bfdfe641a6446dcbfd3f358b59941d9bca6d
SHA512 2d8e82c4b8465f07c0730d4b720789ada5366e595ed8bd81c6db000a42bfe1ceb9c6609df0b7efb6bc26d4da5ef74844e4a090e00cb75cc2bc9a20ad8d550aa4
SSDEEP 96:n4kGX1FWwpvWMoiVmdewidyud/BddgdIbBr1bQUWQyV+VD7AiEwb:n4kILWGWM7dVdpdKdIb7Qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d70cc44acbe1dd3943c675fe007655b47d82d43ea5b93935ce75938e4d46db37
MD5 8c3030e79c57a9453b9153148e68af61
SHA1 4a3e459c8d1bed569c5df7e24ae9f988450de04b
SHA512 b5e5c699e1c1262726a057e6d83153fba1175ecaed6b4e973c40076d5becafdda85388782514527c26ce93d60a6c8a9739340f926d2dccead9c5cb887c87d77c
SSDEEP 96:n4kGX1FzwpvWMoiVmdedk4mLMBr1bQUWQyV+VD7AiEwb:n4kILzGWMNk4mLM7Qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fd23c333d24b08b8dd3ec3e0b591cb07e15b59a31cf81f104c9628784332516f
MD5 dc9e8e7ecbc018044dd8a2e0705329ea
SHA1 fba57e612275df10e4ac8a0561f28a8071cb20b6
SHA512 a0022d946d7d2776df2ae45b9f17aaf56045202cce7ee4b66df21a6061c7bb0186e9708170886cca6fddf13432540463ba21a61e715c2220e03216e61f9424a2
SSDEEP 96:n4kGX1NFwpvWMoiVmdeott2o2BrzbQUWQyV+VD7AiEwb:n4kIHFGWMYtt2o25Qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 836381c781da0fba337e261e1e79c7d777a133a0aab43a0c66a2557f02b484dd
MD5 dacf35235db43651f2e18e1299dd17fd
SHA1 8ae9a7021bf35396783c89852c54e1fca2863c54
SHA512 586695a08d665eba70c0d96ddb0de5cbe8d979784f1abf0cfe3b7b8dff2194437b9b0f5548ca1470d2f3764edda523502d67600e711a00ba582c4d222d745956
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfHUe2RUuMC29s:A9iIxuERzA83h09RZxYfHaod9s
MD5 SHA1 SHA512 SSDEEP

Submit Download