c96e8322580ccf161e324623e2b9acd473f3a8dbc6a260ea6762075797dbf945

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e20bd1adc69f611ffcd6674e81ff80e2_JaffaCakes118.html
Size 175KB
Sample240915-j2yavsteke
SHA256 c96e8322580ccf161e324623e2b9acd473f3a8dbc6a260ea6762075797dbf945
MD5 e20bd1adc69f611ffcd6674e81ff80e2
SHA1 164f936439d9c40be6c4a1e3119447244fec2598
SHA512 e56c8bc663d8289ddcd3f2f8f96f28373f61831716094f02cb5868c3800fcbb55819b41a2b45b2e6dcd32dc237c3a220ae10da749ef2ab3db9582716fed511ec
SSDEEP 1536:Sqt58hd8Wu8pI8Cd8hd8dQg0H//3oS3FGNkFFYfBCJisa+aeTH+WK/Lf1/hmnVSV:SOoT3F/FwBCJiUm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3492	msedge.exe
3492	msedge.exe
2032	identity_helper.exe
2032	identity_helper.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1460	3492	msedge.exe	83
PID 3492 wrote to memory of 1460	3492	msedge.exe	83
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 4184	3492	msedge.exe	84
PID 3492 wrote to memory of 3312	3492	msedge.exe	85
PID 3492 wrote to memory of 3312	3492	msedge.exe	85
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86
PID 3492 wrote to memory of 2132	3492	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e20bd1adc69f611ffcd6674e81ff80e2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd8,0x110,0x7ffccb1646f8,0x7ffccb164708,0x7ffccb164718
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,499414153085665483,2798875538153036750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 26feecbe89a07efe578c133bb739ff5adb77accacc8d5adced5f5e6d68868974
MD5 435b3a0e840b645f292802829dac2223
SHA1 d4fbf559bf804f5a38b129a46cde46f2dd899170
SHA512 77be24b379526ae115efd717819bc72ccf4ff11036f879c9f3f84f71533cafaec44cb24328f398f8d6909de33cfcbf1fc1d9962a90afa1a825498c2a5c65a755
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 862117ebd28b31994c96bd452d701d090380e78adf518a76604a08a5b528ff90
MD5 887e37c3667e27eb17e0ad1b438800b9
SHA1 b34182f3f6890946a03fc8485897cbd63769e223
SHA512 3ad7f28e75a505edc80357e4043ab343ed4e5e238c0f0a66d61d2350a0d31d94f520131ec76b660d79838e66ba4dd4bc103fc925086f311fad8cfd17d3a49245
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 febbf9df459b09b8ebcf9ce2bc1bda74d2ca7258623ea74b2b9e3f3cfed1e8e4
MD5 b4e6e084fc500d49e519dddc2a943112
SHA1 c4258d404de171f25550e9cadbfb6af0eff7e0b3
SHA512 f3f3d402e2c88d6e7c329a5e05756de35dc2c557a5598335dc94dfeddc43f67e58abd08fa13609f253129a6e573f3367bad7b3af6cf1d58551765341394c53ef
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5eb98dac90ef848d55018df7b015223b16434dd00e8ab4db4f0cbd4b81cc8660
MD5 20c58cc5612047b17a04b1299d7121fb
SHA1 cc61eccfeb52d4962670b5a2a85591add630439c
SHA512 ef9a62a9dd902aa35622ab7cf5b9b9091e2ab0a8c089a2e9d746a5530805f41467412711bff786bc573ec8e621e32d80352547e7b938b1a856bbe6fdd5845463
SSDEEP 96:nhk/0L1fulsLSFhPwpvWMoiVmdeH/bk3UWQyV+VDCziEwb:nhk/SZullFhPGWMX43ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 fbcafa69af2bd0ded69dd471455fcf741f647c5e6ed62c6262da0cc939ae48b0
MD5 faa9fb8006a2657bf657e4e44ccf9709
SHA1 4deed6db3ceff335ca09af126f26354074159d47
SHA512 36588b927f676c40a21c2ef4e045940fe327e38612a908e8584d759bc35e2648246e67599c02b9befaf0a6d19857f7ffd6a1e7f82cb8338a82d47334f1948648
SSDEEP 192:nhk/EZulOFhPGWMuTdYxKEBEr0EGzwA243rg:nhhZSahOWmArJkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a7627270094af907207a516b40a095b4f9a77ad8c263b3b952e9d15e08f33394
MD5 6c440b5e7c95c2888d71af21e4c8a2dd
SHA1 3cb644db12c35f7b835b3d7e0a4b6a34ff1e255a
SHA512 53724d95848ca068e4d8adb62cfee93a27e03e49276613069de1d92f57ed81ac205c0b7b29971b67546691d38909f5b64f4f80060eb2b838970cf24bf0740b41
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEae2RUwkxNUnTeuLJ5cmL:A9iIxuERzA83h09RZxYE0PAm7JCW
MD5 SHA1 SHA512 SSDEEP

Submit Download