790807f7639be9eeb3ff144efa1aa9d4eee258d311a182a2a8cca1dc1be0346a

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf81ae6778efb1a2cf03427ecebffdd1_JaffaCakes118.html
Size 86KB
Sample240824-1ycnessbnf
SHA256 790807f7639be9eeb3ff144efa1aa9d4eee258d311a182a2a8cca1dc1be0346a
MD5 bf81ae6778efb1a2cf03427ecebffdd1
SHA1 ac0779590e929f9bfc5c88c5572bc6b935716a27
SHA512 00c6c4434a8162f96ebc0ff54a4c2e7bf762e79e6ef125ce7660470f73d61b3ce25168980fabf546817972d4875321d749be178b8dc45f61be25b541e594c1f9
SSDEEP 1536:6kcl9Gi404oJEJSuIcQSzn40Jlyxt3ZVCPMPlqmtuUoxD:6kclGs8SuIcpzn40JMxt3nCPAtuUoxD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
3212	msedge.exe
3212	msedge.exe
2724	identity_helper.exe
2724	identity_helper.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 3784	3212	msedge.exe	84
PID 3212 wrote to memory of 3784	3212	msedge.exe	84
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 1888	3212	msedge.exe	85
PID 3212 wrote to memory of 3588	3212	msedge.exe	86
PID 3212 wrote to memory of 3588	3212	msedge.exe	86
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87
PID 3212 wrote to memory of 4056	3212	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf81ae6778efb1a2cf03427ecebffdd1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdef2a46f8,0x7ffdef2a4708,0x7ffdef2a4718
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14181217355621560304,1142399453136186486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 1242a049c9121d9fdffc4a592776cfa30caa0dd4e16d0de15b27252ae58675b5
MD5 5397d7f39897aded3a602a59acad142f
SHA1 835dc5208376b0af6f3d5b12550b6bcfa590172a
SHA512 379f53791e00159470c38a61b94464626d149597c784b2a9e7013d4f5c5dc8090aff3a0f2e9be24b93ad952af9a73a84ea1421710faf85a361fc29fb2902645a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 8fc743b301a3b04fbd9bee7d865fc4ea83e34faee7e5dc98313dc97c76171203
MD5 0afa616a61a62e580ce5b7415317702f
SHA1 0ab2a99d0be18e560b065392c43608afe9014ee7
SHA512 3d231b19622e7f5a1033313f950dd2928dc2a2a7a141c42fd1e24f7b4d1b044112eb480263fb3156f385dad9d1331911399ad5f78061593316155bf30128d663
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6dafcca1b70f2b90d0277acdd3561edafa8aa48a7db0514d04cd2d4bcb5f2027
MD5 fcf28f741c9f1a15014be567c3cf18e0
SHA1 070c05a1f41c33b34c3397208787bb79a8f5dab7
SHA512 a968b0bb5ac2d4695d4a13a34cbe023e6f58b0a86c500110f0edd541f7741ccc74f56f9ac32abd895ec8a3be93522ec1dd625887d3a80ed04bf81340f16cd1a9
SSDEEP 96:noAk/+O1K1OrwpvWMoiVmdecfTvikG2lESw624s0XUWQyV+VD7AiEwb:noAk/VoEGWMMfTvikG2lESw62Mrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 448836e5a9c989a89c736ba84dd51da66c4d6645af53559f8ba6549ec9997769
MD5 3db6173efcf7a813bf9f62127102e79c
SHA1 883de8ff85669ab3bc17578a319b07aed4eade1b
SHA512 b6e6919aabf4cb36269c40c6c85ace4e9fd23e4fd19dccfd75b035e20c004c3025090143ea1587a286d683dd54d3d7fe8de3f6e8329ca2b2a2a4a06253395fd0
SSDEEP 96:noAk/FO1K1OrwpvWMoiVmdecfTvikG2lESw624s5XUWQyV+VDCAiEwb:noAk/koEGWMMfTvikG2lESw62XrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

ee84739a-4053-45db-a858-4e20fcd40b5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee84739a-4053-45db-a858-4e20fcd40b5b.tmp
Size 5KB
SHA256 2310c8b8d615d0fd4efcfd6e648c41dfa941f64342c79d2c9632dcb676b24f15
MD5 20e4a159b0392e4cc21017bc73a38472
SHA1 19e1d61f09e413c0e54a0538571df41ebbb2f8df
SHA512 b1ffe7002321d42a2a189dca66a91ed3512807d496f159b5dcc463fb52c679c44c073b9f338751a00e26296ded8e474e498b1c14267cef8a6a68f674143ff3af
SSDEEP 96:noAk/FO1KXOrwpvWMoiVmdeH4s5XUWQyV+VDCziEwb:noAk/koCGWMXXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 94bbe4967f6a97c145ee7ccf348f5551f78d42df24869e7ea529102536c065f4
MD5 0946dd0017b75633f9e7ca7e72aed2a9
SHA1 f6f4e5e8c839d3ebefa8a6826ba9285f9782d6b7
SHA512 98d56cd932ff1d9ac591cf6dbe46b733cae08bfd8eeea4c1c6ff523856dfafbcdaab3b529db9bfa5b549e03faf0d94901190bfe640ce2715663d1fdaa89e19fb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupse2RUsti6KRw5Ytj9Zklq1:A9iIxuERzA83h09RZxYyXH1kLsTOD
MD5 SHA1 SHA512 SSDEEP

Submit Download