e2985496aaa6ba8472aef79e6d072b60bd70f8dc513a12f541bba29479f7290c

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3f3654208148f72eb9c819d8adb43b0_JaffaCakes118.html
Size 105KB
Sample240826-2rxkpazamf
SHA256 e2985496aaa6ba8472aef79e6d072b60bd70f8dc513a12f541bba29479f7290c
MD5 c3f3654208148f72eb9c819d8adb43b0
SHA1 5f9a712072d01ad6d5d24a92d0a0ba2282af945a
SHA512 f50e620e27a6732c4557c4e91ba33697bf672a195bf9e3c426bdba345ad0725ca2a0037e3e7d85ac9f43daa670b7496625b8162ede4d166c60c9a6644959d803
SSDEEP 768:HHsR3xsz7R9KuXgVoekEKILwkEX4zlEml2dK9k/oQ5Vgyb8100yfaiFgQHfl8fbz:HHBzl9KZVfkElwhdKbfyb81hOZ8fDT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
4736	msedge.exe
4736	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 596	4736	msedge.exe	84
PID 4736 wrote to memory of 596	4736	msedge.exe	84
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1304	4736	msedge.exe	85
PID 4736 wrote to memory of 1944	4736	msedge.exe	86
PID 4736 wrote to memory of 1944	4736	msedge.exe	86
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87
PID 4736 wrote to memory of 3160	4736	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c3f3654208148f72eb9c819d8adb43b0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa08db46f8,0x7ffa08db4708,0x7ffa08db4718
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,18286384653326532875,6530140219816658461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 d93097a5617179b368410ecc800dcf3ab3db64b44527f5f959884d66c55318f9
MD5 0d86d40bd4d8c0f0448967989d92c9be
SHA1 14173fdba1b5b43e4fc78e9211fb9b258ec4f0ac
SHA512 a656350f1afd2995228fe651c44ed0ca560dcbf801e8a4d82f5b9b3a251f7557837600caae61dcf18b80d0a09b5528c829fab34abd330a07e0f2d820ab0da12b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 7ea0e9f69951384c1369f421535061a2158a045f905532873617a8d25d98b7f8
MD5 9b0405c64b6183a9abed62e5712c22c5
SHA1 1c6ca1dd3a171ea5d8b3b7e0e388e39c3f8e0530
SHA512 a461c49ab50cc2bd197b9e952758917ec6e1cdbb635dd1189e0b0b84d65b2124e2a522d7dfbf9c985f0f87ebac2cd6376232481f8cb038659872648d6cdfcbe8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 1ecb2cf3d994292c2f8140532228f8e7abf4075b356c69adeb4c38906f5e0992
MD5 687ac64905010215e06c204cb892fd7b
SHA1 11a83d995b570417fce66e6bccfed542aaeb968b
SHA512 10235d55f5ffa57428179f1372da6dcd110fc55db156c39c9b9a85294dad53663bffdf0d125a38dc4c0462ade6855f1c2ad2c711445f26b86bd71ec6286a6852
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 71d6473e7cf3431f7c5e57677f3d6a9361abad2a8bc4644247704eb6504ad266
MD5 13eb3886047cab1a02dc176aa66d4e24
SHA1 2a5582101992d6f10705863b0e68c23792e7385d
SHA512 c018760c69795ca85b2bc787cbe93375e57fc716ac024c702c5ef8c50a5dc00d2d7ea1eb521d31b8f3e94859d78e1256a72e5112b5989bcb6546fc3278c4d0ef
SSDEEP 96:nhkRFoE1aeOrwpvWMoiVmderTPlAlC24sjtE+UWQyV+VD7AiEwb:nhkR7APGWM7TPlAlC2LE+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1ea92614ae0b7a184409ceea17b7f3fc2d949735dfcf2caaa901540316bdf072
MD5 6672320f070468270ecd0909053e1d21
SHA1 00e0fdfc6affc4a4dc379b04f8968f6c0d24f68a
SHA512 30b779efc94b5de742a36e5b6881a4b76b85125d1e87532c1954f6583b17912f8cefc99786837760c5062d59f78521f8d8083ce52fa0ee661eca8fa114f325ee
SSDEEP 96:nhkRFoE1afOrwpvWMoiVmdeH4s5tE+UWQyV+VDCziEwb:nhkR7AKGWMXtE+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cc9dc9024268d9799d1e8558b71501794d1ed15bbcba187d04ecfb347a26ef85
MD5 8a3902b1e72f3b5030581f1081bd235d
SHA1 a85d61b1a686fbc5581a78fdef8500f540f10adc
SHA512 a578f24c5182d1f45bde8e40d57cc7b79aa96000b5088b3d88865d4df805c4c80bb9b1f7d048611e6c46cb5ff826d17ab48b9eb1af5acb6807a7301639c1ba3d
SSDEEP 96:nhkRFoE1aeOrwpvWMoiVmderTC24s5tE+UWQyV+VDCAiEwb:nhkR7APGWM7TC2tE+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 3a8a5ba6a5b066c6ab49f70afa5aa36e4b183644583a12dfab32f3bd67e4ff92
MD5 41dcdad112b88a864cf8215b83dc9c1d
SHA1 7ba7024096dc4c89b6b6800d4af0f3548dbf947a
SHA512 e3c0968d0bdd14be6c4e535e0329f39f6e653c76aba8371675546cb4edba27a0202c05ac534c140b5436a15fdb3182b1ad6e69b744288716cfbfd9350860c930
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupre2RUKi6CRw5Ytj9Zklqse:A9iIxuERzA83h09RZxY7lNkLs7tw
MD5 SHA1 SHA512 SSDEEP

Submit Download