518ad0698f3629fb95a2d288c768290c149467f921eb2cbf0456002232a11433

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2024, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
65104a798b70a533d4b2943f943766a3_JaffaCakes118.html
Size 132KB
Sample241021-bskdms1frd
SHA256 518ad0698f3629fb95a2d288c768290c149467f921eb2cbf0456002232a11433
MD5 65104a798b70a533d4b2943f943766a3
SHA1 5822c54d482c806172be549781c48249588e2f8e
SHA512 47baa8c26f056899ff3e414c2034f4707eccbb5af212fa8f4cba0e9c1bbe5c49bb5cb9932cb156158c9804927b9e4dd787cb146eeda8eb21cfce508fe4ea660e
SSDEEP 768:2Sk1ATx+Bw24Tp7VjO5cLipt+CpC0/gAtnakyhYkmQEDCheNQGOXB9kCjclp06c4:2CHjO5SCpBgNky9Z5jclpXcDO9tN60
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3860	msedge.exe
3860	msedge.exe
3912	msedge.exe
3912	msedge.exe
632	identity_helper.exe
632	identity_helper.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 1436	3912	msedge.exe	84
PID 3912 wrote to memory of 1436	3912	msedge.exe	84
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 4888	3912	msedge.exe	85
PID 3912 wrote to memory of 3860	3912	msedge.exe	86
PID 3912 wrote to memory of 3860	3912	msedge.exe	86
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87
PID 3912 wrote to memory of 4052	3912	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65104a798b70a533d4b2943f943766a3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe8646f8,0x7ffdfe864708,0x7ffdfe864718
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12040448975981532823,4155610898692846828,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
MD5 b8880802fc2bb880a7a869faa01315b0
SHA1 51d1a3fa2c272f094515675d82150bfce08ee8d3
SHA512 e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
MD5 ba6ef346187b40694d493da98d5da979
SHA1 643c15bec043f8673943885199bb06cd1652ee37
SHA512 2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
MD5 SHA1 SHA512

Submit Download

07f26f6c-b3cc-4519-bf92-ecaba69d0377.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07f26f6c-b3cc-4519-bf92-ecaba69d0377.tmp
Size 6KB
SHA256 3626084d9ea24595bee9a22e1679dde9ecee06dfa0af81b7231939e986af19a5
MD5 f5a87e7eca82a5c3e607afa82f625f4f
SHA1 0ef778941075460beb5b1aa5f7e020d1ec2b0b1c
SHA512 3f967e5b4a2b956a33064c1d94644d7671eaacb7ed9a7e525dad64249791b74b7da9b8020699d0f0b642f98f4d3180f57656abb11c31887b0fa54309cb7aac73
SSDEEP 96:n0ksV1pfbFwpvWMoiVmdeN/Ibknt2AnKezUWQyV+VD7AiEwb:n0kobbFGWMd/kknt2GKsrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 81091200864f0db964c673ac057f849f2fbf470ae7d86b4e40563901af0190d2
MD5 392f76ac82dc25bed7d5fa55b0690f43
SHA1 171a70237d958d165b0f805779653155c69254bb
SHA512 73dc7db428c3048939822b9bfe229f55cb2cf7b0990e52ea2ac64e531c59c12366c2c438776730d13816bf317ee4cf752c3d778ef16929c850e85fd23684a3b8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 1e3beaf995143ca0689b8fdb23595b2ca71681d2e647f864604c499904b2b395
MD5 26435d7edaad50e21955d4684e8ea2ea
SHA1 9a6802d7b8a1e290c8e5f966e798baf35c36081a
SHA512 d183c4be071b60d70334635e3aa642b2d2f0dbcdd49ed97a6b02d6d2bf79bff56500763dfd0202176bd58774e93fafbc09ecfadce1500f24457aba5135eed8ae
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6b022e24084fbe5ffc0357076a262a4827ea598cc3aa81d9f4e1016710821fda
MD5 47f9efd2177104a66a03ef7d8ac8f76d
SHA1 c3c91b3b39f97d1c38a8251a4a7f9ca40e83a197
SHA512 63d3199a5e56361f9da24081e2dfebf63e311b7055708859d0488a7750ea6afe6cdfb37b612ce8c2a76881eb6bf54b0f287b5b32f04d9cfbe3540e233cf56669
SSDEEP 96:n0kMV1pfoFwpvWMoiVmdeN/2AnKezUWQyV+VDCAiEwb:n0kIboFGWMd/2GKsrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 58425fd7c86849e3934dd3127856cffde677d12b7dfedfe01265caa82472e081
MD5 864f37e50de0832f1daa01b2fb4829cd
SHA1 90ffb0dd73f14df2dd6d24966d76641144af2482
SHA512 8ae339af58e7eff5b9bd254346b49b50d9402661176497571ac68b427c234033e0bb19197ef2ea075cf1c25be6bed4dce0e2e7e9df980a2f4c188a00bd425d53
SSDEEP 96:n0kiV1pfoFwpvWMoiVmdeHAnKezUWQyV+VDCziEwb:n0kaboFGWMXGKsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fb169f3a5869e66a4540e78e2d92060d943ae3f444daa36f945fdeb00b18bdc8
MD5 5b25e3289eb8623c5b6efd215c5eefbc
SHA1 3272e7b842e447545590fae9f04787f4fd981425
SHA512 eee3ee1b0ea710bdf1e7ed24496b4a1e80e0a378bf07fc032bfa8a59ed6f30094225b0eaece559e1d49a0721118f82b0d0cd16b52d39e8233ec167d2e325d021
SSDEEP 96:n0kMV1pfbFwpvWMoiVmdeN/Ibknt2AnKezUWQyV+VDCAiEwb:n0kIbbFGWMd/kknt2GKsrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b7ad22b1a278a4296e25b16879fb4bc2e3f33213bffaef8a6e25267a51074ba5
MD5 01c2855200d544a11054f9b5a2132153
SHA1 1a20b90898eb84891e7beef5078220951677ec89
SHA512 cae50968767aff6b8e3f77b956ed629b8e06f57a9643ce25429c637e69ca350e58ae31c1b90420bc49f05ce784689ea0eff8f8d7de41492345d3cc3a7103b356
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupScde2RU5ZNh91K3wD2Nu:A9iIxuERzA83h09RZxY75QhPKfNu
MD5 SHA1 SHA512 SSDEEP

Submit Download