0ccc6d7fa79eec52eec314859dd9d360d343a5d504ed369f4faffe74698836d6

Analysis

max time kernel
140s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27031a5e6b79583963a310c456cf5f20_JaffaCakes118.html
Size 210KB
Sample240508-2bzp4sdb62
SHA256 0ccc6d7fa79eec52eec314859dd9d360d343a5d504ed369f4faffe74698836d6
MD5 27031a5e6b79583963a310c456cf5f20
SHA1 32eaf5998152bf88c5c01ef17630376a5cb2788b
SHA512 d3233e7f8195c1ffa492a0d0d8ce1ab53cded8d1a3f133327554316c02c279208f3fdd07e4c03752afc9ae2d16402271672288a8ebd333fe5e199f4e70feb9a6
SSDEEP 1536:CuztRWw2ybY6KkUZxCaHfuuYqE2fJ6O1T0imesZQ5yaeELuKdBs:Cuzrx5Y/kUZvmuYqE2fJ6MukPuKbs
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1096	msedge.exe
1096	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1936	identity_helper.exe
1936	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 4572	1096	msedge.exe	81
PID 1096 wrote to memory of 4572	1096	msedge.exe	81
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 2112	1096	msedge.exe	83
PID 1096 wrote to memory of 1908	1096	msedge.exe	84
PID 1096 wrote to memory of 1908	1096	msedge.exe	84
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85
PID 1096 wrote to memory of 3412	1096	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27031a5e6b79583963a310c456cf5f20_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae9a446f8,0x7ffae9a44708,0x7ffae9a44718
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17989693561689098461,1095122714324759275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 68a4dddaebbd04a367dd9a0391ed726c47e5262874c1be5aa0b27b28dc9e5d11
MD5 d6a2062e89776f8498dcdeeee234e615
SHA1 b920efb28e792e6dd053ffa1e66234a3801df70b
SHA512 a36000d632ecd22490592cc75b54e967737dc9ec9fc17e1887ae0851c32d7085d0448f2fae681eceb0d03b3ec47d8b62c55ddee89ad5932811f908fd49cbfb92
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 1dbf8744c12c4b72b798baa24fc9d850526f20617feddf540a101080db5f45bf
MD5 50e201ac4899cae52516c391b0ebda14
SHA1 49518af247f6b73eb31b3aa66c9b4a3d674f693f
SHA512 efb2bcdcb028544d0ca468368cbd49c2d06085954a8541c4943a671189b11efdbc506610bdd85f8e7c9f98ce005cb4bab0098e73ecef3a916466125638dfc772
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 c53666bceb4f9b57192fe0b4bcead4ff33ddba6a307a0bdbbc551174494db910
MD5 27eefe3b4638ac5aba4e8f555a24f6a5
SHA1 602e3ee46f8d75439c2857886938391eb372e3db
SHA512 be694597875892faf1fa0021a3b8327ea112909a08b5d754e1403dbc99bb7e5cdbe2d5e963162814dcb69f5ab236646276746fcd05df967eaa75b7fb02986567
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4726ea4b8978126380bc46241125e54290aef0352a3832ab4b588eb6120e285f
MD5 9cbda178a93ceb7b24d24853db8c162c
SHA1 54758cfb7d16cc4b343e4f4104243cfb440fb0df
SHA512 df9c7a84fd955ef72cccde97ebb82aa706bc7120992cb0b9354dc3913987e70c8f6f6d82c3ad2eeefe6f06e76b2e25bd8e49e3a59bc747bb7f426a63b500ca91
SSDEEP 96:ndkgP1SBX1wpvWMoiVmdeHBrzLZUWQyV+VDCziEwb:ndkGcN1GWMXpZro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6745d698e960d1d0eae25303158a5367d22739b0616bbf2b3440c1b97e4fbcb5
MD5 02a87302ab36bc3b8afb4cfd8b6cc4b6
SHA1 222fbe85e29dac0c08c4fd47e3af8ee88184b29e
SHA512 b6535b0583ea75bb401daa1fbc2d860fae3d1f4ca76c3f35ccea9fa151c166481a372deda0a4fa3fb8a369f7f29c5f31b578ecc7da2b4e82c51d4f075147a7cc
SSDEEP 96:ndk8P1SBXFwpvWMoiVmdev0KN4VUNYYiLy2BrzLZUWQyV+VDCAiEwb:ndkCcNFGWM/0KN4GNYYiLy2pZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f8f3eaec9535a7d00d97a7f40ba36ed6a425e1992fa325f41475a68bb33ce97a
MD5 e64bd1a0162d12cb1e14e034f38a9b37
SHA1 868f699854eaa826c125f48c38c822aabb9cf3f4
SHA512 0a1b6b0904bc4e991c755984a36030e7d6e151153e7f0e7df9eb73c623e02f7316634765a067a37350b46fc695655c0755bcc5118aad728f40e682d0090cfd67
SSDEEP 96:ndkYP1SBXFwpvWMoiVmdev0KN4VUNYYiLVpy2BrZ1LZUWQyV+VD7AiEwb:ndkOcNFGWM/0KN4GNYYiLVpy2r9Zrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2dc224ae40096b948aedeca1804ce29dac88fa5d79319c78dae8dec9cd637e11
MD5 045dcf337fddaf02e567481898685c9a
SHA1 40e516d6d3a69c77b197558f2622172ddaefeee1
SHA512 c41686d52f1a0bc77b9d87da972ef090e7ce78135035974612a87cc87a632e827b4556f9b852b0ea6114c1926b903aba592320907c64bfe7e8ffb6a801468ac9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmHvce2RU1MC2c+OblfBhDv:A9iIxuERzA83h09RZxYmHqzdc/XDafEf
MD5 SHA1 SHA512 SSDEEP

Submit Download