a444629ee2e16a38f76f9534cede3b0d49d33644334ec51457ce064cfe68882d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e1785acc3901cf937361762012f315f2_JaffaCakes118.html
Size 33KB
Sample240915-b8vjjszbpd
SHA256 a444629ee2e16a38f76f9534cede3b0d49d33644334ec51457ce064cfe68882d
MD5 e1785acc3901cf937361762012f315f2
SHA1 8b535910bab080c0a4b1fef71bcc488a609d0499
SHA512 716b6a9dfdeebefef0426c5d713203316980ddd191219d1dadc3f8fd239bf26646bd25512742562c9b1b15fa6774b5d7fa7fd20d7209ff66e624c8e10a45d786
SSDEEP 768:sopCbGmQUEjIbTz+HQ3o6oIjWQYLClM9uRny38f8:BpCKmQUEjIbTz+HQ3voi/YLClcuRnysU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4208	msedge.exe
4208	msedge.exe
1664	identity_helper.exe
1664	identity_helper.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 2340	4208	msedge.exe	83
PID 4208 wrote to memory of 2340	4208	msedge.exe	83
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4284	4208	msedge.exe	84
PID 4208 wrote to memory of 4280	4208	msedge.exe	85
PID 4208 wrote to memory of 4280	4208	msedge.exe	85
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86
PID 4208 wrote to memory of 1488	4208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e1785acc3901cf937361762012f315f2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8931346f8,0x7ff893134708,0x7ff893134718
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,4904286568109306279,18400920996562637775,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
MD5 ff63763eedb406987ced076e36ec9acf
SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
MD5 2783c40400a8912a79cfd383da731086
SHA1 001a131fe399c30973089e18358818090ca81789
SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 23KB
SHA256 6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8
MD5 a0423f1305547bb6b8f5a4fb1a9fc2d8
SHA1 092dcf1fe57e6bb53821eb754e04188ee70602d5
SHA512 b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3
SSDEEP 384:aAW2VTWfhCNc+bzBo3WuAi3FwN/f25rCT2LduMZ6wHWPbcb1xDtun1GrR1+4JdNE:aAW22hCNc8zQk/uhLdue52E1xG1QCkPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 1f88a3322a1679ecd995fb098837eaa48308bc2561c1d78c404e23c048f9e7df
MD5 35e9ff235a23a33338072544b96ed30e
SHA1 98d6de51046f329f3dccc823370eb8043b0237d7
SHA512 b314519f1d65fc553ef95202bedc486f2e721a4eeeaa23182f7582b0539eb64a18a4d44b1b08385abd265fe4132a6e5191e92cdcf9baf6521f0fdb1cfe163a42
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 9210639eece7c3d9213bce1240dca3a53678eb7110c38d009c0aad78ee624f75
MD5 5f2229e5d9360fc75099205d35bcadec
SHA1 e5668a7140ef53539bb68369dd620ee07c350db5
SHA512 33c49d17dfb519092f0186f636cc976ebfd7f3112cd17233b079a3e62d56170d9e1df9d283ed2e4b15fb366cde35ea400bcc3576d48031e2468733dd960bbb2c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 e6cef68ca94fa6511fc40101c11c480562521a2285bd40f0f4975d0292351e65
MD5 65f39917c8135be079d2046cac9080d8
SHA1 91c6daf60722e06a40e22ff0d42e1228a68a7f73
SHA512 2fd015a922ffe329e8ab5b8473178a46f6a5065be325a37b79306b324493b15fc997a97fe0b237ef431214604d82d2287a69f43225b3534ba448c4962e2f019a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 df5264ef439cd8f09c525197d23269e1bde3326ab6c31eb26e4ebae320c1d578
MD5 07916bb557f3c34826f7d60bec975c4a
SHA1 6e3f78ac38d9e6ce9c67dcc03166caede87d9827
SHA512 2e4200ee0b5d3be10ee8072684d5c225f63f082e1866b8f3c5feb3437e278626fd493d9b5a9eb3f4852f0f4ce4c9353b542c7e507e49afadf6d40ab062e47243
SSDEEP 96:nxkdeqPrQ190s04wpvWMoiVmdeMlj2a00reUWQyV+VDCAiEwb:nxkdxUH0z4GWMclj2V+erV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b16657080c81c6d39ec88eaebc1a1f291e88b66cefd1c82b1150a3244fd71703
MD5 5fbe28c167d3ffee65184d39bf02b446
SHA1 08622cecba09ee053c8ceb833634f40792c77d0c
SHA512 94ea0cbb1cf7b421c4d8a8e80fc31253bfd063534a474977347e418cae9116cc365fc6f0d36ee56d3cfae44968ea2204f01a9de7640c394440b7ba00a4d97a36
SSDEEP 96:nxkdeqPrQ19Qc04wpvWMoiVmde7V2VAXljRtW42a0nreUWQyV+VD7AiEwb:nxkdxUHQj4GWMLsAXljRtP2Vrerg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 607d8400aae80e91037ae0f26687afcac70257bbdb7960e9965c0c94e765bc32
MD5 6a8ef5e75c0a764644fb59041d8db68d
SHA1 67d1ab38f49ecbdc10e8d3832021c620899e05a6
SHA512 294b27310c08299f3b13bd2d4609af8a378916dc3c33568a4995ac0054cfbec994b6f1c90417f9322a02b05e78c4c4b1cc789353c90c790e0b1f47a505462a51
SSDEEP 96:nxk/0qPrQ190s04wpvWMoiVmdeHa00reUWQyV+VDCziEwb:nxk/vUH0z4GWMXV+ero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 dbc80ec92fb65400f4fdafcf513db2a1191c616a7b8c384c78ea131d46307693
MD5 c9922c0d06c076dce93b63b40af3e21b
SHA1 71884045aead0e859b26d15f0e190dc8c5d461f2
SHA512 d48e543acfa161c35d31bb53fe27de1f4a6d34b50221acda984de30aa689d3414c400b43b350ad004065aa2fb770aa005acef0652949f37ac8d4e3c85444de06
SSDEEP 96:nxkdeqPrQ190c04wpvWMoiVmde7V2VAXljRtW42a00reUWQyV+VD7AiEwb:nxkdxUH0j4GWMLsAXljRtP2V+erg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

fc77d6ec-5ef9-49ae-9a1c-eb163559d213.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fc77d6ec-5ef9-49ae-9a1c-eb163559d213.tmp
Size 10KB
SHA256 29f3eb5fd500ebc5223a982cadeace351c533a7d51648c44f7e58576d002770b
MD5 c1c8f1e30933a10c9552e20bff6450ef
SHA1 8219d6f40090a418eae820facaaa10bf371ce691
SHA512 aaa50380030ec4af27d653e0643b841c52fa747693ffe3f257babe17131e736e81fb32702b2c8c89e3c2da37763475f512d35fa479ce96bc553ade722341d00d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiPe2RUgs9A/pTeuLJ5cmv:A9iIxuERzA83h09RZxYMzFh7JCu
MD5 SHA1 SHA512 SSDEEP

Submit Download