2ac033303ebef02f309d7285aa7e70ff3a86e8ef4dcc45a65ae05ff0537ea888

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91476d450209ece838fa6c9f30a003b2_JaffaCakes118.html
Size 240KB
Sample240603-leldwsaa8t
SHA256 2ac033303ebef02f309d7285aa7e70ff3a86e8ef4dcc45a65ae05ff0537ea888
MD5 91476d450209ece838fa6c9f30a003b2
SHA1 40f22abd2c3a1783ec59605bb34f1246d153c640
SHA512 d16d2f99399bcbd1976b663f4cefd5a917ea29548636035b62c578eeda47874ef5248b0a5a61eec73d2a16d3854b53839d4a10c0ac73d15835098666a5399ac3
SSDEEP 768:SyUstekQn4M/Nx1DvYX2Kd1IyyHg+zvdOw/mpe8f/gsSlm0:SyUstekQn4M/N/vPY1Iysbwpe8HbSl7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
400	msedge.exe
400	msedge.exe
1664	identity_helper.exe
1664	identity_helper.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4256	400	msedge.exe	83
PID 400 wrote to memory of 4256	400	msedge.exe	83
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 4936	400	msedge.exe	84
PID 400 wrote to memory of 2204	400	msedge.exe	85
PID 400 wrote to memory of 2204	400	msedge.exe	85
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86
PID 400 wrote to memory of 960	400	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91476d450209ece838fa6c9f30a003b2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe40aa46f8,0x7ffe40aa4708,0x7ffe40aa4718
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2367258654134272258,4035141046080169054,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5ff61d4c-1df6-4f45-9f60-c3629d52edd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ff61d4c-1df6-4f45-9f60-c3629d52edd2.tmp
Size 11KB
SHA256 1ff479ee5f2d991d312da541e3958f0eeb37117a4dba6eec673fb93f330b0afa
MD5 166daaa4841ac7b96d580374001efec9
SHA1 fe4ff7acad1d44848a8f59f1536ce1ad2cf5de32
SHA512 6af54bd3869c273748725fa5310b6483289d36e4128814f5ebe5a495f9f29b26414f42a4dee922e30d93dfced8ca3fafff015c14c069c189bdbd89c8620123ba
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupsHle2RU8DMj2L3z2OMDCRj:A9iIxuERzA83h09RZxYsHB0yLaOMWRHD
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 85189438a7b5f188ba028ef03b175ea83b3f836c894f3c875fc340219eabad40
MD5 fdca451ee00f9c381c623967cce931c7
SHA1 cae77c365cd99bcc9fc4a6f7c91fc20fd9bc30f6
SHA512 98b59429bfb46a6cde2f32d03c9ad416ab8a7c004ee6f1cc8a122fca9b0af3000b99f931a8f622af75803b1af723f1feea25112d5a798c1192c9b36e5f04b0a2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 d28e92a21a2fffd65bb2bd7114c6700f2742bab38e0b8d648f0f0a131dd30004
MD5 c509692bbe7676240b2fd65fe411312f
SHA1 9dda939e43628bf640281799b936958ca2a3692c
SHA512 9b94eac907695edac044b06f15d52a7edf18e7894e12f1dbd1f81095d34b9747669072670d5562bea500106daafc8e25169dd469cb339cad9e4257594fc5c071
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 60ede2e0f3b693c64060bcac340665d6a4b3975485ea521764d572ba81a1878a
MD5 81efa0224180dd84a21bd22845c841d0
SHA1 7dac5d34a5982244d5edd9bc44800f0a09b6e03f
SHA512 5392746aea15b83591281ef07c790eeabfbc916a1119aa48d0a50049fadf8e7b8f040e96d09532f3ad6969f613a3c77aa1ae5c0a85b0c6c84c315f31a8999c67
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3ef53e24711c725f634e4590e78adf12941d1154dd39010feb894fd1d215c0cb
MD5 e479e7b6f0fce01ef5e097d2de1be4da
SHA1 7c3417fad43952e6b1e29a9cbb1658e9afe43dc4
SHA512 d8ee9b2406ceda74c0ec52a4bc498afddaa2a92054ab8b141c4f29c7e289e74899eb5c8f24a091f81e2de18f7ec4b1f61f359a43a099d94a43d2f88c9bb61022
SSDEEP 96:nCkff1t1wpvWMoiVmdeHBrzS9qGUWQyV+VDCziEwb:nCkHz1GWMXA9qGro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c0d8192bc1049369af5e1061821356445296fccd494f14efb52df6858e8b90a7
MD5 80c46e35ff413ff1c7408bd7752f7aec
SHA1 2b672976c7c6343a0673c170a6349a9f623991a9
SHA512 3df4c340a87674a5fcbe08cece560514aa2841737071e6c3538e76102e7c85619ae1e31859541f199f525c6849614da0aa8e3f2ae0d30bb5c019c5d3f9a75433
SSDEEP 96:nCkWf1t1wpvWMoiVmdeM8zES2BrzS9qGUWQyV+VDCAiEwb:nCkwz1GWM88YS2A9qGrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8a3d2fc1076aeec2a017876d107a50fd7ad9a295daeb0b94e523255b5998fe61
MD5 68aadb70b00ce8eda4823f0c12aa67ac
SHA1 dbd8a11b8baf923ae15803654a85776479900594
SHA512 dcd01eb0a120f8eb139f3b218883c19321d5c796ffdb787901773a3b550db115de0430bb7bb2636cad9b2824149ce5b90c12e0a547f6998ef52489d67c3d6dc0
SSDEEP 96:nCkWf1t1wpvWMoiVmdeHBrzS9qGUWQyV+VDCAiEwb:nCkwz1GWMXA9qGrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download