498738691247de596febe6b6808a049eee3cf59f2b3212905f0a087a2255d998

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a94a0b9414448596c815a995e8f9413b_JaffaCakes118.html
Size 107KB
Sample240819-dcketatfln
SHA256 498738691247de596febe6b6808a049eee3cf59f2b3212905f0a087a2255d998
MD5 a94a0b9414448596c815a995e8f9413b
SHA1 ab639ab2dd4869c27825bd988a8b24483fc093c8
SHA512 764eae9cc21e0141343002e425e4da46e04df85003e9329f23e50880b7b6f7051667fd1160113e40d5d677e781305791674616be5ff96e3581fa9540546848a2
SSDEEP 1536:FAd3PBvWBkw/HhU8ptLw8MtVN8St2k8BtYr8FtXc8ktT+8Cthr8itDf88twi8GL9:FAxPBv67NSkrfLFN7WOqGcP+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
4252	msedge.exe
4252	msedge.exe
4712	identity_helper.exe
4712	identity_helper.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 5068	4252	msedge.exe	84
PID 4252 wrote to memory of 5068	4252	msedge.exe	84
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1188	4252	msedge.exe	85
PID 4252 wrote to memory of 1004	4252	msedge.exe	86
PID 4252 wrote to memory of 1004	4252	msedge.exe	86
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87
PID 4252 wrote to memory of 4228	4252	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a94a0b9414448596c815a995e8f9413b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc190946f8,0x7ffc19094708,0x7ffc19094718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1760 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4020868461049801801,13799064887542002643,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 578592ecaf17f27eba759654af812426ed6887d2eee520e05bd37dead8e20238
MD5 1726c7fdc728e7eecede302593dabe6b
SHA1 906f21b2ddfdc6c59558efa764490342a907cd28
SHA512 1b1193500379ce9c2def2964d5ac458f5b86cb59c235a769befa62592b3cce97d8ccacb51d77d53c3d957e3f5ca0ac3486c0afb5f0fc076833f71368fec6402d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 00fd536e8d61fe4cb39b71bec9792ae2db19fbc39c8629d933a510dff6be8690
MD5 c99dcc0d443e63a0ecb5e275e33703c8
SHA1 fdbac91768a299154c94878a90d86a0d5ebeb79d
SHA512 9317892369a347468165dffc698638ad8f46ff94623d43bf9f4cdb02625a0145a92bfbbdfb4d6a2bc85dc025bf065b2bbcfb5a220cf0686997bf8e5147c33127
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 71776af7d66777c36e693d061b99d7480e9dcc094e6b2d4d0f80b8c634dbd07d
MD5 1111f14b24c6050148ebe8066ef3d8d8
SHA1 300e2000ad3fde1bc257ced6d0a0b0c14554a66b
SHA512 47e41e3835327bf9396afc61d622b7dd80d72b1ea4e7bd776b5ee8d41cd392c07906edcf830b0af2aab510c8c20b5f5d931314c892cf822b11de861e4185ae90
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f617cd8caeeb558f23d274fa976d308c7a6c7570e673bb73252c36b6023d6091
MD5 2a31819ac7d9ba0b46084583400d089c
SHA1 e33bd213767c95d01f26e3361019f873cc5a69f3
SHA512 4945712352b10ca5748c4a8bfca2c543382519ee4c350666f10c138e8eb248d249be1355bb846cccd56a7a182551124780c3f1df30816276628a031aa5975e52
SSDEEP 96:nekxo/1zZwpvWMoiVmdeHm9GxUWQyV+VDCziEwb:nekxihZGWMXNxro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0920f529ffa8403dfccd102522c514ffc34a952bacb25e68c23f341c58f83fdf
MD5 5d3826d85aaef691553f3bc78fa748e5
SHA1 7dd0befb5994a037667806a4b6f8bdcb47505512
SHA512 1b6b993ed8c02863cf434cba6cadee52500c636b383055eeff71c3c1b819465439bfa1be4bea99226c809d6b57d2e4a2a70d93e4e4c8aa593a8e03e9e4be2b52
SSDEEP 96:nekx6/1zZwpvWMoiVmdeE2m9GxUWQyV+VDCAiEwb:nekxchZGWM02NxrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 032b83fffa0f26fdc3ebf366251f1ca10de1be44f734cc9ba1e1fbdf75ad5f71
MD5 3ceacf2e26da76faecef5b1193004ee6
SHA1 79be2d8f8b487b3f86338b35a0830d32ad3eba10
SHA512 56dc6cbeb12c5320f24b0de9ee342245ca9652218f82366b01c3cc69d2a3146bb9479ee20883a5ec2e9637f6b57fb19b3bfdc2a953fee8d1af2a3edaa4675ef6
SSDEEP 96:nekxY/1zpwpvWMoiVmdejGJOUH2m9GxUWQyV+VD7AiEwb:nekxyhpGWMqOUH2Nxrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 0efdd8cf7c139d65a3f62f75502a5b9545ad5300b783f96f1fd28bf9c167a5b3
MD5 0f1ac679c9a17fae0657537694f042c8
SHA1 34b941a798a31e90ae38f82c62cc44f2f3b27b19
SHA512 e4b2a7d929d835f8056db3a21a0197590b8e1854211adb95a656b26edd378ad7da5ec880d6caad42acee25a626c5cbbd4eed92ce9efe79ed5ca46fd2e10db61e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupue2RUVlYOuru8z8ZJ0G9:A9iIxuERzA83h09RZxYwmuPz8sG9
MD5 SHA1 SHA512 SSDEEP

Submit Download