0bd10c0a9cc596c334289d5559556a2e1c55f8ce4689bf678cc62b5d114fd20c

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
131f7b6ae8c8c5beddac4f565e16892b_JaffaCakes118.html
Size 124KB
Sample240504-rr4nwsbd42
SHA256 0bd10c0a9cc596c334289d5559556a2e1c55f8ce4689bf678cc62b5d114fd20c
MD5 131f7b6ae8c8c5beddac4f565e16892b
SHA1 b2e58e08a278993deffad5abd1f49a01797998aa
SHA512 3d5b4de4b696872bbd57226cce2c9d915796e6e739463ee4674c3c038d73258f78ba1a18524a11178beb86d43510d0b6ce90774c297e5f241b63f0a122bdd254
SSDEEP 3072:wUcjvG8rMdcXmNRS+ttcp0iGeDsWBhV1/hHUNpNF6F3:orXmNRsGeDsaZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
4764	msedge.exe
4764	msedge.exe
2696	identity_helper.exe
2696	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 1364	4764	msedge.exe	83
PID 4764 wrote to memory of 1364	4764	msedge.exe	83
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 4368	4764	msedge.exe	84
PID 4764 wrote to memory of 2636	4764	msedge.exe	85
PID 4764 wrote to memory of 2636	4764	msedge.exe	85
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86
PID 4764 wrote to memory of 3280	4764	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\131f7b6ae8c8c5beddac4f565e16892b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8dd846f8,0x7fff8dd84708,0x7fff8dd84718
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1500,2145265466579429191,4165461918897819255,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
MD5 dbac49e66219979194c79f1cf1cb3dd1
SHA1 4ef87804a04d51ae1fac358f92382548b27f62f2
SHA512 bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
MD5 a9e55f5864d6e2afd2fd84e25a3bc228
SHA1 a5efcff9e3df6252c7fe8535d505235f82aab276
SHA512 12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 20KB
SHA256 a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47
MD5 397383c90a2d930f866f405747e27466
SHA1 7bb6b5d6cee104c877dc5c3462f61232ffe5b360
SHA512 4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoKQP:kBF+i/PvVIOSVi8vSmzXjoQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Size 44KB
SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
MD5 88477d32f888c2b8a3f3d98deb460b3d
SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
SSDEEP 768:zznaC0S3xL3KmGLYSKhxDefA2ihGqfz9fNfh0QqdgDnqQpvSjCQNs9f9wAcCGI:PnajS3x3K1JKPCwhLfZdh0Qq6dQNef9x
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 2f42483138da1ccc511fcf26374593855df6bb52d2fbbb19420c34ff97c11612
MD5 3878e487091229d8f51e72c494a0abab
SHA1 4e5f7162181ed074d5d076c44bd9341d2acb1706
SHA512 25b3f7ccbfd35e289f29951a5f00b5074a544cec6245b4f7357904bd77f4cf0a39ec3add802c6aa681cf5bc074b21e30c0a7a2b7033aaaa4ccc4c20916ee176f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 2da477134e5ab7544724997a14b6ac0e25e66aee8472145135f83363f60b662f
MD5 d1068a604240b6520d0835c4b5e46b40
SHA1 88b9e54afef839b0a4b253178128dfc15faa96e2
SHA512 89c1cc01c8322a117e3fd5341e68c9b5e9d3a69c99631aafe579d8ce05fe9f9b0f72b1cd402a65c9e82d0722f7d25e80a194b8f51e7356571a97ddc5933e45e3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0d134aa31c9d3d68f9d813e374a170a4951af741a602d2af34fcea704abfee06
MD5 c6d0ea531b10a3a54bc99ea8923823df
SHA1 068da0f94b97388b909c6152d18e067caeaa6084
SHA512 7552c6317ca993b070e9d46f1dca291cc987d2b3cae9d7a8f78eae5d8d4f1596018dc5259fe24b91b5909091dfcf89fef4a9749bd3fb389f8aa97564dd355a1c
SSDEEP 96:nydFkaCdN1SQ/hXwpvWMoiVmdeWKX40Mn2ZqGUWQyV+VD7AiEwb:nEFkXNgOhXGWMmKX40Mn2frg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c42947e780d097b93fa72ba45df703879ec14ceab7ee5bff279fbb0d4025ee9f
MD5 9d499a9dc9f305c8b7274ba655371685
SHA1 3b7a323ff8575621956537f4d54681f6aa9cba5d
SHA512 a1e038b90fdc19ef6363c12c23eee4e96c9d2b5608f0645e2137272d30cde7722cf85e9276880aa24f03e7d52f83a2970eafb21f283a49fb6cb0ec768da70687
SSDEEP 96:nydFkNCdN1S6/hXwpvWMoiVmdeHZqGUWQyV+VDCziEwb:nEFkKNgAhXGWMXfro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d644024c7daccb24b81f3b1fcc6ec83225133a2bac5b9aa6142cc560590ee6d9
MD5 ba68c988130819e448c5898d9feaba8b
SHA1 62def2eae8058499e82b22d7d24333c681fd0a9c
SHA512 8f6d176ec740adab0b53566fa41175dd91e5f49757892a0bfc222aacea2adaa1cd1ad62f3ee61ab7d01f100e0cece029b68fb478284a7f8e0e0a788d8f72f776
SSDEEP 96:nydFkICdN1SQ/hXwpvWMoiVmdeWKX40Mn2ZqGUWQyV+VDCAiEwb:nEFkdNgOhXGWMmKX40Mn2frV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 48b388f90213a57cacde2b9411b871084ee9236de80858a1c379db91c81811e1
MD5 4c8fcfce1037265509a16a2c4ab9bf86
SHA1 9ff4bf0cc66e6ac1e441a9871e62ca8c8aac177d
SHA512 071355b58de9f788d8f217ae62e740555454e02db2b940dc9b2107fb2ea3fba2c99657a194c614d3b4e673f5ebae37900f60f11b4ec7224d66258c73677cc826
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqYie2RUndwqGlL+OblfBhr:A9iIxuERzA83h09RZxYqLdlL/XDafEBd
MD5 SHA1 SHA512 SSDEEP

Submit Download