53d49e728f41ce5483568936e842aa4be321bb9641f631acb31c4f62d107fcff

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c920a4f97ff302929bbf7800a12c53ff_JaffaCakes118.html
Size 175KB
Sample240829-s8shma1fkn
SHA256 53d49e728f41ce5483568936e842aa4be321bb9641f631acb31c4f62d107fcff
MD5 c920a4f97ff302929bbf7800a12c53ff
SHA1 f12bd85b879a410f4a79cc8d0ef32af33648d845
SHA512 173c4e1e2d1700eb9dd8d871cf55ba550c3a565916cc45a6b220d0a94aae75725a74a6227dfe30cf20c77fc7d95745e363715433d1958f860f9bc3d038e76c08
SSDEEP 1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3MGNkF6uYfBCJisd0+aeTH+WK/Lf1/hmnU:SOoT3M/F0BCJiEm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
3092	msedge.exe
3092	msedge.exe
4516	identity_helper.exe
4516	identity_helper.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 2484	3092	msedge.exe	84
PID 3092 wrote to memory of 2484	3092	msedge.exe	84
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 4760	3092	msedge.exe	85
PID 3092 wrote to memory of 2348	3092	msedge.exe	86
PID 3092 wrote to memory of 2348	3092	msedge.exe	86
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87
PID 3092 wrote to memory of 5080	3092	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c920a4f97ff302929bbf7800a12c53ff_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffa62ab46f8,0x7ffa62ab4708,0x7ffa62ab4718
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,17749303469016960042,15457194875022029650,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 2e36683d0da4a33a722ae4a16fd298bc38a20cb40866719bcd1c03f80ebd7f84
MD5 a054680794fe0058fcce21001658e2c6
SHA1 591adee331dfaeef8a90b59c01c33576c6f9e246
SHA512 f30f0eb6eed96c67d404575dcdc5abc7fa97e881be4b47ad81fd36b1a0dbc0a60ef8697028ee9331e20d9a1a329f274468bed8560c2f37afd8073880d2bb7a62
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 8194233fc84d8488d95afffef09e33c505692873e487412f677606eb03b56d85
MD5 61f6d0683f52b02bf9f65be4f72a3015
SHA1 a7c57a0e6a39c621c862b97ba8e8783a376d2b0d
SHA512 f28297ab5e389fbc657d60830e125b7870e06f6d43ed6e00a23ba0db472be4f5dd0ab6a40a08184716b9a148cc583855405d414e1050ca773ace396ed1244953
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 7f0897e8b0183a79b333d24e194af62c803085b9d0a7fee604a310544e5b5162
MD5 e0c59dba00fe9cf7e5aec01093cbf161
SHA1 facab851502400cfa2b602e5f0186a8303cce414
SHA512 34b84119628fdbc346a451a4db260bccf00e8633b9ca45b82e185f2fbd22be0749c953023cbeb41f67584c6fa1597c795772227f2d06ef363678b85e0e423215
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6f1ee9c556d351ac2859451829994d69fa45b7c2568a693f9ad2816ac52ab658
MD5 960df0ce625b60a14a26e15c0122aa44
SHA1 7583ce5f2b501f7d54239e414f280ed91d9b8ced
SHA512 2c07520d355027b7c6093f71db4bcad0765f3328038953246ebcc5c1a795748dad08dbc6d8a87167b7ee16a900a2d33b4b9c3fff59a8948cab72e4fd0bdc404a
SSDEEP 96:nnkza61UzRwpvWMoiVmdeHm90CUWQyV+VDCziEwb:nnkzxYRGWMX5Cro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a110414f14693e9645b4f78e49d74a70baf6fef8473b196b23c3b1419031c035
MD5 8b0735c7f61e7736a7063ef8e1422fbe
SHA1 c741d637cdd86be6f1f70b2743f46ab1a56c485e
SHA512 0d0efec7bdb84d290b2fa069361baabc2773d1a04c624c92a6434619000f62b16a1b18769cc4762deaa65bcc542f4ab2ae7e3f536d394777e1faeb07963035da
SSDEEP 96:nnkzE61UzowpvWMoiVmde5VDRuzE5qYErLE9Dopg2m90CUWQyV+VD7AiEwb:nnkzrYoGWMJVcY5qYErLE9Dopg25Crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d85bc282aff96482de149c0b6bf45614b265e29e8582d16a9fc45fc47083ecab
MD5 841ba0305c5656d9478d181ff99dae10
SHA1 5cea64c66489a8c96a9e55fb6b3368402dbf4aa6
SHA512 3e56d5f0c0dec31999cf8338167f14ea78232ff291fbf2be857dc888418f5a5dc03dbe1cdd0240c44afdf6515829ce0bbb93709d97022fdb341dda322cd54c27
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSe2RUvlYOeRw5Ytj9ZklqU:A9iIxuERzA83h09RZxYsgxkLsT1J
MD5 SHA1 SHA512 SSDEEP

Submit Download