79a2c59173aaa5d8a637cb4c594a906fc7b61ed53d62e62edda5cecc9339f599

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c07fdf8b2235b2f3ff03e099a6134263_JaffaCakes118.html
Size 204KB
Sample240825-l4emmszhkj
SHA256 79a2c59173aaa5d8a637cb4c594a906fc7b61ed53d62e62edda5cecc9339f599
MD5 c07fdf8b2235b2f3ff03e099a6134263
SHA1 f8741eb3e3cea1e5d44eb856e5d78ac15dfba9c5
SHA512 98af276da5217f87016005b46d6e3c0577dd75106b802f23ef98178e91357d7c60b2323bfc2f693f3ec005cbf90a02e6b08fcb0ea6a6cf16f8e58cfab7e2f567
SSDEEP 3072:qf41Ppb9ampNCSlJGaGodnh8odnhNI+QTsTqg6t69Ht:R1PpbAmTdJGasxI/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4172	msedge.exe
4172	msedge.exe
1684	identity_helper.exe
1684	identity_helper.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 3840	4172	msedge.exe	86
PID 4172 wrote to memory of 3840	4172	msedge.exe	86
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4136	4172	msedge.exe	87
PID 4172 wrote to memory of 4852	4172	msedge.exe	88
PID 4172 wrote to memory of 4852	4172	msedge.exe	88
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89
PID 4172 wrote to memory of 3308	4172	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c07fdf8b2235b2f3ff03e099a6134263_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc0da46f8,0x7ffcc0da4708,0x7ffcc0da4718
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,14663482444051016336,10139036119901480426,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 f8142c99734834b7125e72263f8a33dab1b34d5facb2860f6eb7ab253adc4361
MD5 10e9918ed4373266b8a25c6911fe328a
SHA1 e36e9f356d5952a23e4ae0443215e6e7b1f90161
SHA512 7c9b8c57939af0f4d47a18c3a1346eda56d10e40a944a9daad7e9aac133bf9ee7e767e7874faff2661362e2beb66fcd10b1041985559a75f3f14516bdf151a83
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 d3a11549ca449d2407635f564b57d1d221eb995ceca32cbb5afe120dfeee3f4a
MD5 d98d1bb9086c2dfec3ea1781c6056e0e
SHA1 53aaaa46594eed152c2fe7a9472834ed6f90426d
SHA512 ce8361448e2049f6b0480f4039866cadc70552be48cfdaf40e89698e23e1619f10d454ee213bf77522cb01b634c856bbc4baec7182c6c56599c6642e2bf7e6c0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 426334175cfbdf8a51f02654170145af5d79226153e5533993ff5a4cd265da02
MD5 f0eface21352b418cb1eff2f052c3471
SHA1 265c2f21fe94860d93776734d3fe8608dd4aca02
SHA512 5ac5ef246e3feb7742931861def9c5060f49d1bee8c4f88981aef7a1749d56f36f5cca14073ecf4f98a052c0c8335262b3d35e68cc0594558fccb691666e41ff
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 122c4658861e5da509959d4eec7ddd65f35408decfa9004eb8263886b80898c2
MD5 584bdec1225cef8d003d73b65cca5fe3
SHA1 11fe31077885d965e5e80cae3934b51dd164d9e1
SHA512 90d45f49a3b35850a5e995ea50d4f6c078e9ee341e28e76c7e08f5b95737a914fdabee19c03a312f580887e4e82a79bf4473f53b2e0ba3272acff84fc36d6430
SSDEEP 96:nofkzFz1cDTNwpvWMoiVmdeH44YAHUWQyV+VDCziEwb:nwkzZ+lGWMX4Gro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 31e93058c36644356321de0182c3ae8314f8f42d5dd663b6f376bbbe4d22aa9e
MD5 29aa22b0e832f68462fb39f8cd006971
SHA1 a0fe877abc68055d4ee047151e7623de8f722b2c
SHA512 78606e16d80883b45086443c7b1b0d8f3c9bc1970aa395e4087248245a62f62f9efa156882d67ee66e141ed8121c11c43d9a66e90176630c31f73199f04c1840
SSDEEP 192:nwkzZ+GVGWMyiSa25YdeX2vi4rDc+24grV:nws+GoWyxrN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e1cc16503ec92b04f539e1473f5eeadb79e401992c7854cd5cffa4add3cf7e3a
MD5 8c699e555ec0cd29337419a20f2510c7
SHA1 25a7c6426b0922c514a17bf3c9f05d8abcf1ec9a
SHA512 e3866c1d4e6db22a8b4af7b423fc3bcd7b3a63036f2a4fb5870ccfcbf8e20935a080c286928ed92a5f319fbdf48f72facb38d06d51c2a02fe9aeb5adb851d12b
SSDEEP 96:nofkzFz1cDTNwpvWMoiVmdeNSa25zEWY2ErDcS5244YAHUWQyV+VDCAiEwb:nwkzZ+lGWMdSa25Yd2ErDc+24GrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9abba8f0384629e16cc077941578cd1ff3a7435aa10e3240ab9d88aad38f9f6e
MD5 aaa356d6af3a358f2045c5975fde5b81
SHA1 b7a31bc68a6d69e21eb25af0cff8a0e1bd607c9d
SHA512 ca01eadd1053cb09fd7efb0d520d3aaf93823c30dc7e9d23761dd1b5cc981dd0c3fc2bb2fa5ab251c066a255c4444b5c562cadf108e61e2acafe409c5b2fe59d
SSDEEP 192:nwkzZ+GVGWMyiSa25YdeX2vi4rDc+24grg:nwY+GoWyxrNF
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 41d15b27b6bcdb24c0759761e8654fc961d76a69950544ce52fcc75fcde7e369
MD5 11335b00caf5561de78298c4c2fa7d63
SHA1 f87520a41f59bd5785ab5264aee4944aebd14e73
SHA512 2ce673ac6bcf0a183d914779e84d957a010011b261a1222330a8bf5421221bebe506c3b09f040978fd74bdde666b574c1ef03e538abae3a07921be7e9ba700b7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexups9e2RUpOkWRw5Ytj9ZklqI:A9iIxuERzA83h09RZxYsZwJkLsxbN
MD5 SHA1 SHA512 SSDEEP

Submit Download