5f327cbba85e382947b06a8fe02ff5b3438f84be4de5b0b95b7945a2612b6428

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9123a7a3ebffa05ba37908c364691e2a_JaffaCakes118.html
Size 175KB
Sample240603-kf98zaae48
SHA256 5f327cbba85e382947b06a8fe02ff5b3438f84be4de5b0b95b7945a2612b6428
MD5 9123a7a3ebffa05ba37908c364691e2a
SHA1 5b37120669543cec9f0991b644983cdb7baee685
SHA512 1a6e70d788e2fa870b93094108ceca8f26cd55eab395294c4bc1d5b31931a6495a322c994338ce59b6f65c9850f731b52cfb6640ac7c7ed2faf8e56d465569de
SSDEEP 1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3dGNkFRXYfBCJiZn+aeTH+WK/Lf1/hpnV+:S9CT3d/F8BCJiOB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
2452	msedge.exe
2452	msedge.exe
2536	identity_helper.exe
2536	identity_helper.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2176	2452	msedge.exe	82
PID 2452 wrote to memory of 2176	2452	msedge.exe	82
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 4860	2452	msedge.exe	83
PID 2452 wrote to memory of 5076	2452	msedge.exe	84
PID 2452 wrote to memory of 5076	2452	msedge.exe	84
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85
PID 2452 wrote to memory of 4244	2452	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9123a7a3ebffa05ba37908c364691e2a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe401546f8,0x7ffe40154708,0x7ffe40154718
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4473253178876627003,17615668142201469162,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 46KB
SHA256 2ae2564f74716a4e44850d845f0cca255c6c0c3a7dc0c8ee6bfca0212cc394ec
MD5 f871dd44ae8c9e11c5c85c961f8b2ab1
SHA1 7618910822a0f2639b405e3c0b13faff0431140a
SHA512 3b9638f705f83e37c3e0c9db1205b2ac76b96ba72ac56013a6aca6f34a7a9ff3548e8fc67d2b85c9f23f8337f696baa8fab01523fb04b5fd618b130501eed47c
SSDEEP 768:ORCMDx+sxzB3K91pTuAPhAhbh9ScwzB0fILVpV32YJEGtOnExKv+QTXyUjSL5p:UCMDbP691pamYSHScL2/YOEg2QTRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 6449ff13ed0189471b06b627b40362bcb29d304a72a81ca3db6f3d00d19628e6
MD5 be63cd63bd6e32e1aa851c6e1fcc4f58
SHA1 b9ece9d560bbb5f08c395480411f491f7837049d
SHA512 97638af3afd3f045728d54a6ea4696f70ed89153ca407432685a9cdfeb9fdf67c690913af116e39368f3d2db9cd3da7239ab0dee35980aadb4e72037c03b330b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 427b8ecd671dc6d3be40a5934ee1239f2222cb9acde6ab2d968c1cdba8c2b98e
MD5 c7e3a29ff474cd5607cff9b1629bbf09
SHA1 112a67df90371772c2d41286cfd661646541c551
SHA512 6f7863d057a13668abf35d8c074abe2e833b458323edb49c235dbcb7ca61d33d53bbb4cf07c279180c77500f478102a42f57c0655514f1d0eafba7244995c04e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 adb43fd0671ac22f78e4bd2bed82981ff0db72f5c33a9375fc529e4497e97298
MD5 6644863fae3b6814b59494cb6f95c56b
SHA1 5ed3fed64d34a01cf85126a8501f6d3fb212125f
SHA512 5ca1bf237be268918a7e51d892c7f7280d0aa62b163d7b3892ab9f0d1429bfb5096372bb3642fcfe4790f53f0b5fc2616a20623825f21ffdde56b59b2de11c09
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 98e85e717cdef8dbffffe23c31bfee7c4c99b28623123fe5f5528571cc60c6ea
MD5 3ff4c4103a0835d9f0408fb8f5e86d3d
SHA1 06782f698eeaa97bd391a67cb7dc4e607b12e5d3
SHA512 bb3aa25941665e0aa042f01ff6c5aee1cb85a3ec5793d22a35c500c37707931e3dfddb94987e9c720074c14a04dd8db3b95cd924d9ddea0a1b16f4e2029339cc
SSDEEP 96:n7kFq1hlwpvWMoiVmdeHBrzeUWQyV+VDCziEwb:n7kgflGWMXsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 eabb8ff75a885c46ef33f4504de6bf5102153244ba5a668bc67aec3e25a09dac
MD5 e691255df65e28700cf5cf9ad205a5e8
SHA1 ecab310e417ba9f4e9147993d85f6c1dbe4b873a
SHA512 d44498a380ea756805ffbab0e5ada2859ef918e3d60688413dd44fa7c93781e279e8d7b080feb6edf81d07fb34f6006423a681ee34b91458bb2c0e01d2187ce5
SSDEEP 96:n7kgq1hYwpvWMoiVmde0V+RuezEtqErmExp/Zq2BrzeUWQyV+VD7AiEwb:n7kXfYGWMEQjYtqErmExp/Zq2srg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 52b0bdeebe6056ab469134557b57c0cb6b1adb96b2d3c6556cb9ec2a247f43f8
MD5 c0b31e5f7f206728c476f4726a2a9318
SHA1 a45cfd8c786e8942adf8bcb5b9b6f1fd22b43cb4
SHA512 e56b087211091a6964ae7e97193ddbef0b4da6a2dcb9bd7db4c9c20f6e40413f3c1abdd3d8ac8be05df3e18206d21de7df4e754bf6d4b6b1dce3c85c053e7a74
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6H/e2RU3Mj2t3z2OMDCRHq:A9iIxuERzA83h09RZxY6HHhytaOMWRHq
MD5 SHA1 SHA512 SSDEEP

Submit Download