cd775e9303e67b5caf309e9b68dc4e62e5476406332ae77224283c96a0f56bc8

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2024, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
753c7c95f9cbebfbd04f563253109477_JaffaCakes118.html
Size 65KB
Sample241024-3absbsxcmn
SHA256 cd775e9303e67b5caf309e9b68dc4e62e5476406332ae77224283c96a0f56bc8
MD5 753c7c95f9cbebfbd04f563253109477
SHA1 6718a35e9a8d6d92ac06a482e7a8bd49ed8aef19
SHA512 a8f8be430884cee57fb9a9d48340af527ffe260e9a1cc63ce7100d5d3e2b5458821987ef2408447e03687cb705c3e12b6e7ac3c597cd7385257dd9618effbe36
SSDEEP 1536:7V32i/juqQhtmMcJKOvygDhtng5T0bIFe6WErUJ2EweZ4sVL4UNRj:J32iK5cJKruhtng5T0ZZ4ANRj
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
10	sites.google.com
15	sites.google.com
16	sites.google.com
17	sites.google.com
18	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
1092	msedge.exe
1092	msedge.exe
3248	identity_helper.exe
3248	identity_helper.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 3896	1092	msedge.exe	86
PID 1092 wrote to memory of 3896	1092	msedge.exe	86
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 5112	1092	msedge.exe	87
PID 1092 wrote to memory of 2016	1092	msedge.exe	88
PID 1092 wrote to memory of 2016	1092	msedge.exe	88
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89
PID 1092 wrote to memory of 2676	1092	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\753c7c95f9cbebfbd04f563253109477_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc634746f8,0x7ffc63474708,0x7ffc63474718
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11756064484699389485,4404509123010050773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
MD5 56a4f78e21616a6e19da57228569489b
SHA1 21bfabbfc294d5f2aa1da825c5590d760483bc76
SHA512 c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
MD5 e443ee4336fcf13c698b8ab5f3c173d0
SHA1 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA512 cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd
MD5 SHA1 SHA512

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 42KB
SHA256 9b59525954d9da17ff56cac0c0cda55bb6c4df6b7550fe68565fe0d24a963ac7
MD5 101f2295c59a6c129b95bb68093aed06
SHA1 12f5843daaf99bdb874dfebaf10660c54ede2120
SHA512 f5e54b7609a1884253f1d05d9245def95b3721e1163ddabb6d32f5b31f824a218c60533eef25a6f91d8ae6fa314128ae258fdc341cf9a4f36bf378e874b5277f
SSDEEP 768:BxjJZM9YDBsMMPqV41xckRE2jiwZSGzvxQCkmamkEsyrdiggge/TZXm7xnSAD5Uo:HcYeMk/9+bOp8ZyrdigtkZXm7xnSANUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 791c819a012e845c1ccf3d1ce51ca94cc96373791d950ba10c82e24e9cbb7abb
MD5 50fbb16527553860711036db41b203de
SHA1 ddb9b90986b179730a5a14c258e1a0f4c14c5f96
SHA512 d9a96eb1736d67ac0bbdc271ef289587a144e68a40370c42279a048e51f44af84452bef57373fd2e8bc3fcb8b3f492b974282aa460e4338155fb5ae7905e4400
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 cede91a8f5d3dc2f64c18e10de4e15382d272cf72a562b54864a86f13309289a
MD5 429acf84d0369c969c83f6b1f81d7731
SHA1 82b9a633787e140f7f79011edb410ae1267314aa
SHA512 7617ca202126148806dd88713432b3cc13c59b239c911a424c77c0d2a257f0b4e63dae2b0af86f9adb2503458da4af2d36ca8fe139ee06eed3b8844b02066b33
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 e53a7143744d4c830d587140f6ab4f67361ef33f5ddefa34b838d820e6be91be
MD5 a2431c5a187ce4cdd0c8f6d987a4e34b
SHA1 c8ed9c0f9352868b82c723123b6c0a6e326af534
SHA512 dd85f22b7f5e6cd2d3acf44a1e11861ce6931a10201c9a8112550e30ebacf59b8a54218131c0fd8a5bcd74f4417cf304a4bba575644db7d512342860dc64f378
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 059534236547bd037d2894a33ad761da20c0f9f3fe653d5e4b463dc08f8490ed
MD5 b150cbb4f2e4be8a8336aa56a863c83d
SHA1 924d042bf5e266cfe1e3f20227e42e4d003a8242
SHA512 e412e2e10b27ec38b7e8fd66465a6f0c7b38d116fbf729eed9c1cf8c999a08b1a50f71640b57f4334f4df88a39a2fc010a2d17ea886c547c0092c7727cbacdc4
SSDEEP 96:nTFkADk71eDwpvWMoiVmdetKatST5YWg2PAQBUWQyV+VDCAiEwb:nTFk6mQDGWM9KkST5YWg2bBrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 60c7fde1f2cef9f7cb4967ce6cb7fdcec2952dd2489148262e8e7f801eeb1cdd
MD5 d683c328f6917cab7fb7c07bd18e805f
SHA1 17fbbd9d2272fd0e870f45ccd9a0d1d2edeaa9fa
SHA512 0e2340e6aa683c4733153fdde92e2ab2b2eb87293dfce81f5a6ca178a088cbba0c013a84f8680ce6a056c2521c09cde97be835f48206e6884a47e8268aadb773
SSDEEP 96:nTFkuDk71eDwpvWMoiVmdeHPAQBUWQyV+VDCziEwb:nTFkYmQDGWMXbBro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0192b2b48af67090aec7f51bb9244c776e64970da401fabddc2f94bea33a0339
MD5 5684a16750f0833d8a6507f8772530d5
SHA1 f3a834ff73693abdc9a0e2a553913206fe45dffc
SHA512 fa5466b6391c220f1f142b539b75da712b297582acdadb59428db1c036bd0425a6c26587c063fbe3bedc2351d5345320d51879b5017cb869112a6a4a6e335318
SSDEEP 96:nTFk4Dk71eJwpvWMoiVmdetKatST5YWg2PAQBUWQyV+VD7AiEwb:nTFkimQJGWM9KkST5YWg2bBrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4331ecda99a9e6637477bfae5059d9fac77210209a5711e28c0400e0a5085335
MD5 dc2c9ea54736cac62316d2e0a7ec3b5a
SHA1 349c495189f319d79aa02ca7f5f46386a0e8ae7d
SHA512 cae9bcf508d8e93bb30cd3b9d4907d6907697a10192026c0871dbacda9ec76c6406e3fda34c83a307a6d4dff8de1ff0583786d187e8269bf044950d11603a069
SSDEEP 96:nTFk4Dk71mJwpvWMoiVmdetKatST5YWg2PAQBUWQyV+VD7AiEwb:nTFkimkJGWM9KkST5YWg2rBrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e3ea0cd3473d02bba58a154c0f3c58420187874d6db23aadd28a0e15ca090a6d
MD5 dd640fce497394fb2e11f68416a3b266
SHA1 efef3ac6b2549eb9ef1d1cb77d1802e1e8ee330c
SHA512 86a4c2f8bff46ad2833ac488e9ef416475eab8896875020ac8720a738a029133314f9b90997a587399e2efde0b242e4276849bd5d5e313472a140d5908e6dedc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmiCEe2RUT8mJp1K3wTZIu:A9iIxuERzA83h09RZxYmUQJDKYIu
MD5 SHA1 SHA512 SSDEEP

Submit Download