61d4bc361a14a297ced5e85590d88af0e3559350154438f1312ce8c5e5d21960

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffef3029616173e2c2c8f2c02d9300bb_JaffaCakes118.html
Size 81KB
Sample240930-erc5qasamh
SHA256 61d4bc361a14a297ced5e85590d88af0e3559350154438f1312ce8c5e5d21960
MD5 ffef3029616173e2c2c8f2c02d9300bb
SHA1 005d1790284b5bee8e74561f50559ebd54a74a6e
SHA512 c36f2e02a4a0c4229171f4a79c70783768a59af6d99eda0a450b874bb9a0f24229b2b5eced817373d260e4a2ba45e0a801863a63a5f82724a477c4d9745fe111
SSDEEP 768:snpglhgOriWNuAYoWv89NMewuj6OXz/lmuKLS60TXBC3MbIB9Z+Q12Sq4ZEUle2v:spmYxv89NMeTr53NXBaEouUlp
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
38	sites.google.com
58	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
540	msedge.exe
540	msedge.exe
4472	identity_helper.exe
4472	identity_helper.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4516	540	msedge.exe	82
PID 540 wrote to memory of 4516	540	msedge.exe	82
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 3172	540	msedge.exe	83
PID 540 wrote to memory of 1748	540	msedge.exe	84
PID 540 wrote to memory of 1748	540	msedge.exe	84
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85
PID 540 wrote to memory of 512	540	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ffef3029616173e2c2c8f2c02d9300bb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe54e446f8,0x7ffe54e44708,0x7ffe54e44718
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13937862547983519242,13846148261813579739,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 17cd77c5e38139817dad61477166f946e86b02bf73df890ff2e18e11c22dc431
MD5 ca3224f085d4a2258ecc2909630c5b99
SHA1 139c0bd8417be550e32ff54c6e09fed4cd3ae5bf
SHA512 0a666cedf6f888a44494547b4f656998997c1b61e8eb56184640904fb6bc7941bd6db4f472d7b5b23d0544ecf633d5e9f28107729a9c005f5a1c1cc98fd483ab
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 ba1f286cb95fd3bde27bdf8f66f5c3f2bec34797ba802733c58d5f4179a02fe9
MD5 cad92ebe1cc2c23d1c44329ec3c1422b
SHA1 4bda3169f05f127a4b94d0d231a823769f6ae999
SHA512 05d97d604cf60c88b6d8b1406b822133a585b3efbe76fa0d81820659ab00c071a6eb92d149ba018aa07951a09fe1d79ff0e163044084f238d0a0261701ecc68c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 89fa88f1037ac8a14dabddb0e14f7360b303d8d2040ced3527b4b178d219d618
MD5 6e1a8cb142b207e0235a59bd4801ee48
SHA1 afa75c0cabe2f8e0ff802ab9add97ae8b9bd6bc4
SHA512 097ee6bffc4b82f9d6ae2d4db4bae03bfad0510fae88142714b65ff187186d75618cfee28787cd869e217a24fae11dd8a760528c7e8358f03b4c0df28ab6ecbf
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fcd5288d3059f172e4f9719658a9640e2c7c38a24d7af611d405a327c885bcd6
MD5 43d61168a9e13841e4ce58e94cd58edc
SHA1 730f325eb892da9adc71a899503deafda008d85b
SHA512 a9b6884ed5c75224bafc3db51b16d326b78304bc37b4ac91ef8c2a6dcad78e7a6ef63e5141408e3d6c1da44063de4e5993dd7739fa9268de4f4dd7581c429c3b
SSDEEP 96:ndk/2e1zGIbvTNwpvWMoiVmdeH44YAMUWQyV+VDCziEwb:ndk/BUIbhGWMX4Zro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f410a5f8c8540bc40a1c01d7ec38f1ac47ad1477749bfa73e834b3920c398cf9
MD5 f86dbd5f305676a2139f4dd535bf6c00
SHA1 bf50186eac6767bee2746e0061d253570431d97e
SHA512 0b151b866143ade5d4b8e87c97ded4444df8b0fd4eef0833c2978453c97e3b7f7f1e198c5f8275c57dd8dd29f5aaa985e9e8e45d36e564ac60774c46f8217deb
SSDEEP 96:ndk/oe1zGIbnTNwpvWMoiVmdeMACNerf3qtYdN244YAMUWQyV+VDCAiEwb:ndk/DUIbZGWM8ACNYf3qtYdN24ZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 efe98c7e1b72b964f93b446bab2ff541c21510d5b5985dac4732245e7652f72c
MD5 58c8b2cc2438522826ea9fc9bd580198
SHA1 667c5cbb5188a83bf37e2a71bdc8be7d968643a2
SHA512 19713c2c973ae30710ec45507ddb7803a84a3528949a455d80d12122508f404d69579b59304fa86b09303adce7dfffd32a8f77affdf7c8c0269e5f9ebb179f48
SSDEEP 96:ndk/Ae1zGIbnTNwpvWMoiVmdeMACNerf3qtYVGdN244YAMUWQyV+VD7AiEwb:ndk/bUIbZGWM8ACNYf3qtYVGdN24Zrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7c6335b28a6f177515c62fbb292e08f8d5592b927f71b45bb75daff0aa32ab25
MD5 1a537a7ce17ca11a1806eb83a7abe76f
SHA1 2c6922f379545261200efba6be5b865753953c1c
SHA512 3fb719041b2047bedc725692a34c8bf2331d861022e29b3ad3503bad44fdb42fbefb7325093e41a93b659197c430685ef8c80237033b0061d2455454279400ac
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupYe2RU7qOkeIcM/bo5Zxu:A9iIxuERzA83h09RZxYWM23qZxu
MD5 SHA1 SHA512 SSDEEP

Submit Download