e2b782aa0aeaddc013399144be92496cde1271c2549cb8ce262f392353d6a83c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f99af8a8faf69379aca35222f50783ad_JaffaCakes118.html
Size 56KB
Sample240927-drccrasekk
SHA256 e2b782aa0aeaddc013399144be92496cde1271c2549cb8ce262f392353d6a83c
MD5 f99af8a8faf69379aca35222f50783ad
SHA1 95410e4b7cabf4e376a4a79a811f1f5f0eb853b0
SHA512 a60a3de41c154f9bbecc79ccae3a7ee9d67342489a86f187126539f7b5f45a0aa19a5396e3cb790649d61082fae8b8f7e9dd76cc820034c0c56d84645888e123
SSDEEP 1536:jVwDeCBkfAXJvjjzBY8keA/NyQtWBqIGcfC:jVwDeCBkfAXJvjjzTkL/NyQtMfC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
1780	msedge.exe
1780	msedge.exe
3868	identity_helper.exe
3868	identity_helper.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 656	1780	msedge.exe	82
PID 1780 wrote to memory of 656	1780	msedge.exe	82
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 3768	1780	msedge.exe	83
PID 1780 wrote to memory of 4020	1780	msedge.exe	84
PID 1780 wrote to memory of 4020	1780	msedge.exe	84
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85
PID 1780 wrote to memory of 3376	1780	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f99af8a8faf69379aca35222f50783ad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5f9846f8,0x7ffe5f984708,0x7ffe5f984718
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1372 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1301305983545555619,10638239559354791318,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 23KB
SHA256 60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf
MD5 2f24e0f5d2c2997a89fb4a8d943c141f
SHA1 99515bde1a5bf72105116ac902ccf3db1dd3df29
SHA512 0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d
SSDEEP 384:VSCKOXcXVC6fizIN66yBc1Ei49Zvi2fSZ886pETkDCm510VS7X+r27Z:aOX/jd6yJiOZa2aZZNAFmS7X+rEZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 2b62687acc2420cbc37f601ae1d38f481ddd655e84ce6f74208a87d385fd87a7
MD5 a93e0d84f2f1416dc16055e8b7960170
SHA1 78fa0bd1c27a38494e17fa477d445cc9b4949147
SHA512 1a5a46214b5b6de41248c06ab1c1b0ef547b2538cc2a3152e8a52d6d9b0f8b7ed43bd42aa708b72da520593d798d33e3229601c607ebd068809d845ebd27207e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 87a5e958d6620e9f9bdcede00ea92ad939932c660eb507996cf7bc477e82fb8c
MD5 38b5283896a4c8b673c894b6aeb53947
SHA1 67d5740c09dae93444af934107d8348475905d7b
SHA512 94fc642904f7c542bd107f555b166544a28257b9892e099e5e5c59ef3773daa4d5cb40ab01508bb2bf1b5636987c45f65bb1f284a33a337b00485fbcedb23258
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 f0923b9e0b363989f5ba3208de23e7da17777eba60974d0adf7acb89073d2bd1
MD5 d6b1fcc8786fa7257e484362be14c60e
SHA1 12eecb3e21055d651cacbc2f69177b6d37f111aa
SHA512 48f946002157de3494564807467b511448bcf37f359ef38de8efd32913033d0d5c0117a22ab88bc255baea816a0fe276a270461431741e77cd4cd2cc3856919e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 550fcab98a52943397307418c98902aaafb96d3493ba21962b94ac3903789b13
MD5 44812f9805f0b9f4405e34a8b51ff95f
SHA1 2f8329b39974658a53ff1b65686df76057f802bf
SHA512 aecb7b7083ba5d43f865f1e3615e9d0f5b36d657c3c74206144a92584447f5b545347d92ca644fdbd1a687d0e6f3196498e407d400e8cc1301c027fb73cd9a9f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4cd8b11bc946111ab8531168e0d8ff664c50624c88534266a4a9493c6f571301
MD5 ed66af84f4050dce3796b0faa5713796
SHA1 25517c85b83d8d295e0c056cd6e62bf0fe6f2554
SHA512 08cc80b226736790d388cb98c080024c0ed7c14ad0373559d53c3ccadeb9ae433b01ab986882fc1e381be0abb442f6df72e085fd2498afcff8ac9f8dda2cc84b
SSDEEP 96:nqk/ok1g5x8LSFhPwpvWMoiVmdevS2/bWcKUWQyV+VDCAiEwb:nqk/5OVFhPGWM/S2acKrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 2ee2a1aa3724c649e8c1fff9e909a8c2d98b62e491316bdaaf7a286005b42e9e
MD5 6227a149103a3d337ae49d16f14f596b
SHA1 e62640c3731a6d4af5ada8a77842a1a5b194c281
SHA512 961518af0bd37b44040c8f40f5f91074f50acf1e9b73342bbb66a9cee4b8839df2a6e9c99b3596c2f4e9586050de6384d604a97a1ab2ab5e74b13622e58b696a
SSDEEP 96:nqk/ok1g5xyLSFhPwpvWMoiVmdefpO0n7MS2/EiWcKUWQyV+VD7AiEwb:nqk/52TFhPGWMvpO07MS2sHcKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 11845fb333ae559ff46899c8cb77a9e6e15fd90d6d3ea62b0982310667253145
MD5 84882af3601cdbaf75292103d26a85e6
SHA1 5ee6ca591a5342a2575b525ce789e0a41bced6f0
SHA512 3855cdf6254fb306c83e0e5403ec5522ca9a2bc91e0146c528e4f63de5a495dc2bd2d039f4f3eeb0aeb01a0ee8552642a731797890d78963b9945e9f0856c071
SSDEEP 96:nqk/2k1g5x8LSFhPwpvWMoiVmdeH/bWcKUWQyV+VDCziEwb:nqk/TOVFhPGWMXacKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d3145440a9a9538748ee0272ccce32a8fd832a4ec2238e284113fa5c49084d45
MD5 a72db1e9a24ae041e7381c1c2c43aa53
SHA1 7cae8266af6292e475a5e7abe031e1929d5e8e13
SHA512 99fc32ba448ebcf99b3ac2cf75e0c9ebba28cce7d6f9b9526a7c2c31890957ee1aa3012f06f083dcc1f221ff38893c8c632471751a0a60c744e88b0b2c3e8b02
SSDEEP 96:nqk/ok1g5xyLSFhPwpvWMoiVmdefpO0n7MS2/bWcKUWQyV+VDCAiEwb:nqk/5OTFhPGWMvpO07MS2acKrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9df6fdb850ca4633d37b935f27a1b798a0ac4d7e66662fa6b175b23c71583acb
MD5 4168b8649fd4f9e136f3e0677d865cfe
SHA1 47b38835de23973ee36cca54e021a665ec2bd1d4
SHA512 28ec8ba7e4ef4e0e16a482825aea8f5ab0dfd7f2f2315afdf3cc880d20fb42de79bec6bee11e335dc5483e4b8ab128b75c0d45d6d520b662ed5a49e6f417f692
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup9dze2RUMxNzIcM/bo5Zxr:A9iIxuERzA83h09RZxYLjxUqZxr
MD5 SHA1 SHA512 SSDEEP

Submit Download