0aebebd832cd2ee6bee7a066bc4ed5c0d14ed404083dee092f742b7541d3cb83

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0745981bc211eafa239cb273b2bbf5f6_JaffaCakes118.html
Size 482KB
Sample241001-y2zagssdma
SHA256 0aebebd832cd2ee6bee7a066bc4ed5c0d14ed404083dee092f742b7541d3cb83
MD5 0745981bc211eafa239cb273b2bbf5f6
SHA1 370485c531d98db0364d74ba3d0d4a9c7a6cfea9
SHA512 eb2b984b6d6b1e2a9b70e0ab131a62a53925122585bac67f98a7913b17462d8d7f5a3e9fd8e4210cd9ee5c6302fe71633dba7714f2b9e2d6886bcb54ba501375
SSDEEP 6144:bdofBJyHvxYfXF+1ymp1fLI0RrurEhgOmrYW5:HYfV+1xpvhgl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2412658365-3084825385-3340777666-1000\{4ADAC13C-5D1B-4EF4-BEDB-A429867D68AC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
1308	msedge.exe
1308	msedge.exe
1632	msedge.exe
4300	msedge.exe
4300	msedge.exe
1344	identity_helper.exe
1344	identity_helper.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 676	1308	msedge.exe	81
PID 1308 wrote to memory of 676	1308	msedge.exe	81
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 3364	1308	msedge.exe	82
PID 1308 wrote to memory of 4480	1308	msedge.exe	83
PID 1308 wrote to memory of 4480	1308	msedge.exe	83
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84
PID 1308 wrote to memory of 4356	1308	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0745981bc211eafa239cb273b2bbf5f6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd183e46f8,0x7ffd183e4708,0x7ffd183e4718
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17008628855696934355,10418960680916212184,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
MD5 ff63763eedb406987ced076e36ec9acf
SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
MD5 2783c40400a8912a79cfd383da731086
SHA1 001a131fe399c30973089e18358818090ca81789
SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
MD5 SHA1 SHA512

Submit Download

5acfd2db-7f9d-4177-9b20-a997a90024d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5acfd2db-7f9d-4177-9b20-a997a90024d2.tmp
Size 6KB
SHA256 e7537db298424b3011f59ff859edf77d140539f264ca8ac05e2866e053b44a42
MD5 080c8aca592700c2678e0886f43b7788
SHA1 f0f4eaf5a8b5c7afaefcf6bd1379654aec455eb3
SHA512 a98d2b5eeba11a90e41ad3a01df6fb39c2e0ec0313b47fff904ada430d7d9ff7ffba0b1afeb23fec45f334718a12ae8585ce93b645692c632badabcc8a88fc4f
SSDEEP 96:nakRoq13k904wpvWMoiVmdeg8Gsd2a00L+UWQyV+VDCAiEwb:nakRLhkW4GWMwid2VG+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 a5879a3259c148ece1888c50a0f78026b3eca0f6d2ee8228956ab5a02fff9e04
MD5 c4487e609fad464e4b9ce28ad52d82a2
SHA1 95cb57f88ba6881427acb117578bfed71ea66b2a
SHA512 a10ecda602972b85d9310f4611c0f38011f66028b3cd56f754b5dd648c1c3b7dd74ea204f8c1b45e7dd25aa2945c34b262ab76ab9662e6c08d77d73297db5048
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 186ee5a85c49530c0b87df2067f704074dae4a2f70342e1968caf43156255af8
MD5 be58266982cf145fc027b219a3992e04
SHA1 f32e18673ae65410accbcf468b69d262e81803fa
SHA512 a8409c0f046d0f64f63d6126dc090c24fbf73102128e7184caba08496f3c662e88c4057a0d8b60982b839aaf5a18fac822989ee7b0cf06278554a6bbb952899c
SSDEEP 96:nakRAq13k904wpvWMoiVmdeg8Gsd2a0PL+UWQyV+VD7AiEwb:nakRjhkW4GWMwid2Vj+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6d56515e3d2465bed2f6775342fbf56465548823d0159b934859eb563f00786b
MD5 2e669b9615b7eedc9893a4fa86090776
SHA1 62e4049ba66b598d42d3b0f3286d2a16ca44b260
SHA512 cc5c7c87985a1f42446e115adacc003489ab01619e3c448f8f60310dddf28077149b0a9373a8777d0b17ae87874222eda39db5e70c6f3dd1535dc446aae7a898
SSDEEP 96:nakR2q13kg04wpvWMoiVmdeHa00L+UWQyV+VDCziEwb:nakRBhkP4GWMXVG+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8787f19be7eb049cdd0c0fe2c85e80ff0ab7b38b2c1ba3e3911f2eab26cb665c
MD5 352d098489cd6dcca6010543a03d5178
SHA1 c625d1caba9b7a6d76736b193df024ad779f3df3
SHA512 4073a24c12a9b5db3352739d51883a033742ae8f0dfbf920b2e89af4f46a7fbf46f7e597836876b4afe02b2afa805f6f1c024d8e0365206643194bd33b1b4e2d
SSDEEP 96:nakRoq13kg04wpvWMoiVmdejGsd2a00L+UWQyV+VDCAiEwb:nakRLhkP4GWMPd2VG+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c30247203657f19073cced66cb980670bb5d2cf9b3c34b53abfc097fe83b120e
MD5 c41056c5759b914e0854ce916c1f9ca4
SHA1 991465091837d157bfb724c4fdff83e37901783b
SHA512 431c532037f956f1333ab2c9400f0aa21d1b610cd0ca8c4059b6a131aef1c00a21a3be2b05b7bfe1474c121b2385b1dc4fd55477f7d6683ebc0efbb4a8522f1e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5se2RUn9A9IcM/bo5Zxn:A9iIxuERzA83h09RZxYgX+qZxn
MD5 SHA1 SHA512 SSDEEP

Submit Download