ca47486ced3a0f3743ce515224c0ab2c6dca2eb5777fc9b7d945bce051529911

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d12598a70db30af8eaca5b4128f79739_JaffaCakes118.html
Size 13KB
Sample240907-ftel1aweqm
SHA256 ca47486ced3a0f3743ce515224c0ab2c6dca2eb5777fc9b7d945bce051529911
MD5 d12598a70db30af8eaca5b4128f79739
SHA1 b583d07dccf63f4257881e6e3425c256f0f82798
SHA512 135e2b85194806c544736f51a8124abe27f549c54ce872fa8f51296e4a39419448cb7e1e3352047b1c247e815780021f1fb14ac9879440e15a79e7e21984aa0d
SSDEEP 192:3bAa/ZLhK5jcjvtSMBsIC3FgF+Zj+QT2BYdBIcwPdLEm1Cxuuaw0d0KlmP3KTALt:3xhScZhdF+Zj+Q2YdyP+miuzJ2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
3720	msedge.exe
3720	msedge.exe
1372	identity_helper.exe
1372	identity_helper.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3020	3720	msedge.exe	83
PID 3720 wrote to memory of 3020	3720	msedge.exe	83
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 1232	3720	msedge.exe	84
PID 3720 wrote to memory of 4756	3720	msedge.exe	85
PID 3720 wrote to memory of 4756	3720	msedge.exe	85
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86
PID 3720 wrote to memory of 1792	3720	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d12598a70db30af8eaca5b4128f79739_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe15b346f8,0x7ffe15b34708,0x7ffe15b34718
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,4044254632667538107,15349378627103086243,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5368 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
MD5 53bc70ecb115bdbabe67620c416fe9b3
SHA1 af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA512 cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
MD5 e765f3d75e6b0e4a7119c8b14d47d8da
SHA1 cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA512 a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
MD5 SHA1 SHA512

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 212KB
SHA256 7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1
MD5 08ec57068db9971e917b9046f90d0e49
SHA1 28b80d73a861f88735d89e301fa98f2ae502e94b
SHA512 b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf
SSDEEP 3072:tG3zu3Ek6OGff9u9xmHDyzB2m2niCRYd16kwEaqKk35LaHahdU269cWQJWU7/u2Y:tuNH9BHM2niUY+kyqKk6mCT7ULuoK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 d5879b70e7f97126be6c51e5cacb1f2bde91dc422be4f43a5e999ea1d082da1a
MD5 e26f5ed96fd91a0ea94838f1eac94548
SHA1 e79bff5a610d1361b58aed31a683c2afbd588252
SHA512 2b187ea4bf60f35f0750c9f40fd896cda1035d2332b4ca4c7406fc1d35b4f814157b18371c3790bbf9e07d7e03ddf1011f6f671131762cfba71c7cfcdc42063e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 48f4dfa55acc688d0864f4a3a3a65c5d760dbf2908a0a064a668d5d14386b84f
MD5 70f49ed8487e90cac758021cd4c743f4
SHA1 5bd2777561b8142c7a4f224db1ec753ea766d5f4
SHA512 72cf0ef24c1bcc00b25b12369d72113817937c77d4d4fa3811d09a33383f92e5b1aae67ea429159dba3a551ff87c5e58df03d44154204dda38cbfa97379d8ea9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 02efb14e8ce582ee0a964a8c986af888ff6be813ccb69f76221b7c69c1af2854
MD5 3797449215056d9fc25f89a26d82f8fe
SHA1 04bd1998e5e606603b684d05a8ef8468ac119504
SHA512 86bec05bbac4da984f63a71092c914df6b2973c2145960a6c57874bc27d07f32b755ab78879c2cd33e138fdee04765169da0000b4f1b86d0bf936c6a4f034a4d
SSDEEP 96:nmkxXK1o5QwpvWMoiVmdeH85qr5UWQyV+VDCziEwb:nmkxae5QGWMXBro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ab790569d267e6d170882783e11d55ad88ed5021021fc51003fe09872ec9bcf0
MD5 db85f17ee7416a904b06d9ee67aa5500
SHA1 605f8bb30c319af0bc5b88ae5634f300426f4764
SHA512 66a3bf869688679bc57d34acf50819cd63727063c9d274206af9983c60c93e32295e438c96c23b21193cf00cbfec0deac04dab27f2ba02b414b8b1873838be5f
SSDEEP 96:nmkxPK1opQwpvWMoiVmde3JlTmlrwlSNl285qr5UWQyV+VD7AiEwb:nmkxyepQGWMplTmlrwlIl2Brg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6b9bf8ccc7c3d59087bee29811c91dce804b490b4b0f8b936d14c22ea1079930
MD5 078c212c6d91da0ef77b73cb41f5e0e5
SHA1 90a456283c02f288cdb92d2b450e3fdf09f9f14b
SHA512 e8704ce70e4411a2976ded9f58d38606f2742d4990fd759e3e05a623835d8c045a732bdbf30ba338764b1b4cdec1a4c747aa767cefbbe54690901e39428a208b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupaRcl2e2RU4k7i+rLQOl6fk:A9iIxuERzA83h09RZxY2oYtsVrSHyp
MD5 SHA1 SHA512 SSDEEP

Submit Download