3137ff68209eac1ec80b5c063fc0be5c6534e6b9089cf2632e40162312fa3f5e

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d541cacaef71efbda38ca287a11ee72d_JaffaCakes118.html
Size 68KB
Sample240908-24xffssepe
SHA256 3137ff68209eac1ec80b5c063fc0be5c6534e6b9089cf2632e40162312fa3f5e
MD5 d541cacaef71efbda38ca287a11ee72d
SHA1 a550da0eba54953ed54305a52b4c530969a66087
SHA512 36ed25023c81fa30c9b5964077db0a499d6a4999f2393090a8423acb17091aafda38561a30d91999c77d5d84cb1748aba78149bd06dca245faee57cf18da38b7
SSDEEP 1536:7kcl9Gi404o2EWSuLWjn4yZVCPMPlqmtuUixp:7kclGsQSuijn4ynCPAtuUixp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
1216	msedge.exe
1216	msedge.exe
668	identity_helper.exe
668	identity_helper.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe
1208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 624	1216	msedge.exe	83
PID 1216 wrote to memory of 624	1216	msedge.exe	83
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 3692	1216	msedge.exe	84
PID 1216 wrote to memory of 936	1216	msedge.exe	85
PID 1216 wrote to memory of 936	1216	msedge.exe	85
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86
PID 1216 wrote to memory of 4332	1216	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d541cacaef71efbda38ca287a11ee72d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a19c46f8,0x7ff8a19c4708,0x7ff8a19c4718
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1764 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10557993398829433837,13041630859541748832,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 67778802075328173299866c8937776ff12c19fefa2321eef7e9b02b659e836b
MD5 498446493d9bc96b48192da73f1fe2ea
SHA1 d0a91f6f94f8d3395a9e3ff0ce8d4d798162473d
SHA512 46ab33ecbd4c743b8e69f85c7c2aaa26187e862e20c0e737f24567da8a2c704b816b0f111c5cb21c7a8e8176a41b6c6744f418ecc7828146ef3a99b5fb2c368f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 4647649c091b4361554b7605566d376e0ce3aed6ac0e8ecf6a619dba519061b8
MD5 be801391a250838a27b628fe7eff8be9
SHA1 5a9c209d1fa4151557ca65d7633dc73fe0304466
SHA512 fa1cd6658e7798208dbdd3241c3d90f012524913f8b1823f7024af819e95ee1400135f2d6946d5b2907f2b618c1d6ffa4f58f67e7c417c296d2e01d32e7fcefa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6dc2e52e539d19071d834db0efc1fe3892bb4ef120c1fdd6f31e3abba00a0dce
MD5 1b52c5a5819e60262590b13e03d25949
SHA1 5eead999e5cafb1f45a07c420a705a92522a697c
SHA512 c73f8c607502e3ee994e144e0ab1f6a3699e2c4a53b36e71ec18a5bdba268c26b8f70c7937e92366b9d573cf32e3d86855a43393279d3abc4bac09e099913238
SSDEEP 96:nBkzX/Y1dTOrwpvWMoiVmdeH4s5fkUWQyV+VDCziEwb:nBkzAPOGWMXfkro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 69e867c026e6aa8bdee5283ce754c84d097204e278a5789de542b81c51a19c81
MD5 412e611d20d9498d707928e5b8b03e34
SHA1 e7e7f0115f2849533e5fb1447b36bbe4b806e405
SHA512 16a1dad5d9e7377fb6ca1376bf2ca28684e98435b46d53921eb26a9aba59c969d64ca703e6ff99d05866db117aa77c407d1e56f8e635a3cc6ba2ec20ab031cc2
SSDEEP 96:nBkzP/Y1dROrwpvWMoiVmdeJf9LmmSQHNqEt4R24s5fkUWQyV+VDCAiEwb:nBkz4PwGWM5f9LmmSQHNqEt4R2fkrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1aeea15c23ceaac778ee01df1d01e1262bdd0cfbd8ac57f55b0251abc755d634
MD5 36bbcbc9f8f8d5ffd5230cfc392d44e4
SHA1 c36ada588d1f62e7bb6b9b52c40958904e50fbf6
SHA512 f9dd17d072099dc0378df110377451ba6ac70b4ce330e7da47f054ac6359772f915a4f6e9715f89c64fb71fff0d21dd20b3ea035835d2df485102b0cf5065fa7
SSDEEP 96:nBkz4/Y1dROrwpvWMoiVmdeJf9LmmSQHNqEt4R24sPfkUWQyV+VD7AiEwb:nBkzxPwGWM5f9LmmSQHNqEt4R2Jkrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

bd72144c-258a-4d98-90d1-8c8fd37d09ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd72144c-258a-4d98-90d1-8c8fd37d09ee.tmp
Size 10KB
SHA256 4d312c2379148085804bd6a0415cb029385c62033c2765fe1929489a5c22e73d
MD5 2094b24f167b11679ba49ff4243853c0
SHA1 937bf4b0da006bd7ce7bb8a166fab2261c7cfaae
SHA512 16396740183496d3f433193b93f7a97034f021e9894a75aa7aee0745ae444528b86d03ab328f190ecd6394a72344fc65ec0a5a27132305de4316656111f831e9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJe2RUUi6iTeuLJ5cmp:A9iIxuERzA83h09RZxYd/i7JCo
MD5 SHA1 SHA512 SSDEEP

Submit Download