a9244ae7d53aed3df44a9788026f4c3d983c8a1047342b7f216021f03bf79ec4

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1135fc9588dd0bfacdabfadfccb4925_JaffaCakes118.html
Size 80KB
Sample240612-sdt3zayhra
SHA256 a9244ae7d53aed3df44a9788026f4c3d983c8a1047342b7f216021f03bf79ec4
MD5 a1135fc9588dd0bfacdabfadfccb4925
SHA1 153686bb253bdad7147f8e63b25c2bb5ca2b28a3
SHA512 8cf0186237f27346f2ad8d92425401098b5def1fa84a93ecb13bcdae81dfa33d685e6cd04219775d1b951089281c7a6f3eab0a5021233566eca2594bda039011
SSDEEP 1536:8CNIcpGDod/XOtIOKJOnYfI6rOI8O5lOhqOTWXHYG4NXchg:8CNIcpGDc/eZK4nYfTi6KTTWXHYG4NXJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1704	msedge.exe
1704	msedge.exe
1740	identity_helper.exe
1740	identity_helper.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1996	1704	msedge.exe	82
PID 1704 wrote to memory of 1996	1704	msedge.exe	82
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1672	1704	msedge.exe	84
PID 1704 wrote to memory of 1028	1704	msedge.exe	85
PID 1704 wrote to memory of 1028	1704	msedge.exe	85
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86
PID 1704 wrote to memory of 4612	1704	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1135fc9588dd0bfacdabfadfccb4925_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4fb446f8,0x7ffd4fb44708,0x7ffd4fb44718
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3176076391279496638,9608913125771598224,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5540 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028
Size 44KB
SHA256 6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce
MD5 23536ccfe05b737ae639fe63ee4cc435
SHA1 6d2e9822835dc3e6117a4d2addfc8f241fbdbc82
SHA512 f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d
SSDEEP 768:feIhQcf4fkrTpidkiSOT+S2k9j3ulT+qZcOkgaONCHLex1RiZW+s9Ux9J6:feIhPfkgFiiPk9j+EM5XCHLex1Rp/UxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 7581bf45e60a3426708abaaa24f94a1aecf05009dac48e01610eb4b3bc414d55
MD5 8ffb1002a60ca511af08f7841ae31bd5
SHA1 99cba007be4289b99d2625a56de075b3e627ef36
SHA512 bcb4ca0aa92de8474bcea877b0571d7fef9741b31b5b3fa96001c47caefc7192d5699dd09f566d7604d90b8f12a9ab7bce3b97a437057aef74f21967cce0c46c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 a05a140667e363ad2a9b781c10be9f4667e169c9634ce89a2d40df5ba606e435
MD5 4b55fd1ad76403b34286bb4ad48ff306
SHA1 fc20ad9cbc5de3d5f8150958b2997375a8f8958d
SHA512 39d5580c58d806e7d96690e70625905290d34ad09e7f3f24e83b39861b8c68eba16c54361414a453cb28c42487c9680ac1d3f05b0c93c7d966b6cbf81a453f03
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 a677247fb409285e01809f06573792ce6d6f6cd31dabc914ee1a71bad2e1628d
MD5 aa3f6d483a88e45003d78ebc56add827
SHA1 38361010fb09fbecf38c517ce12f98623c8f0670
SHA512 de355a4e5913f0590cf911f4588ab76878473d44d711fc13d1f66c7778868dfc2339cb0c63449730c337385951964ec141608003f702cf002a6f763068fb1914
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 772afbb2fcde35170461cda1b2d5e4fcf6d7ab1b06adb812a7106b7bf69ff3d6
MD5 548866498124e12dc0de4ecaf0a4e692
SHA1 63d10be53d597bddbeee27665d325180220a5229
SHA512 eac2e0490ad18eafd41f4f3c96ca39968efadca65f908c447912be80bb566144dbcc0f25f30b4bb2c5860a63f56b8944b438f7ccc91fea96d1bff37fe01e3425
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a0287f00e96250c09263a94a6e3cbe05f594958830f18d3fbee7d352fc68cd7b
MD5 15d2111a40ea29acd302f852a09d791e
SHA1 a6f3a6904d5104a0cc4d2c31f5a58215fb13fe23
SHA512 c0cacce13ecf17630491624653a1ae6f19979d753d5ed03c2bec30b1e8e48dd39c0ca9facd27c93012c624c68701089d16416602d2de5a8ff99870379ec7e61f
SSDEEP 96:nqk/R51VCmwpvWMoiVmdeH1DotUWQyV+VDCziEwb:nqkfDCmGWMXmro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e812183c933ae49a8b3f24887aa2849f173093a40eb721817affc593e9182760
MD5 16d08c3cc825b2ce111e8a0ac0359887
SHA1 792169108d8d764db90b4259f8f806c9ecfada83
SHA512 66b997809aa69ada9b4e78e14ef767d4dde7c0d67c69cd38960f69a8e251e8519c3dc04f565f063dc355f97f56201bdffe2a478faeac31d98edcf08ba6f4c60d
SSDEEP 96:nqk/t51V6mwpvWMoiVmde3+mzE1pn9Er7XSN21DotUWQyV+VDCAiEwb:nqkDD6mGWMH+mY1pn9Er7XK2mrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 c20c53f3fe828eb8994d3db0be7d9a20dfeb40634b4ef17b5eaa6fa3e6f1c021
MD5 2f85fa5071a54de9900d6c6167a27bd4
SHA1 7d78981de41a66f1aa40feee828d16855a1d4a6c
SHA512 9225d722792ff4fff660022b7aed544e313e1d297cfeb72ebb5630fda65d1219921d21d772125d53325fb8456cbd0b25b1e3c0763e137441dd87241901a7d7e1
SSDEEP 96:nqk/x51V6mwpvWMoiVmde3+mzE1pn9Er7XSN21notUWQyV+VD7AiEwb:nqkfD6mGWMH+mY1pn9Er7XK2Grg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 70f91b2f81284f68200071a26e3182dce93f0ffa2cadf5611927aab4633d3951
MD5 674767900abfe85c5a37e7fd8785bc6c
SHA1 0878e57b60fc55d8946b5f2ec03ef025b18689b1
SHA512 ac16eed02c238d934fae1e32aa0a12f32b4509bd5ededc82a5c495a19ef6979eb4e3c1c3af79918aebdea94dbc1e24d929e29d34c173cffad7a0cf1dc49f6546
SSDEEP 96:nqk/t51VCmwpvWMoiVmde3+mzE1pn9Er7XSN21DotUWQyV+VDCAiEwb:nqkDDCmGWMH+mY1pn9Er7XK2mrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4de545768d7b5befeb787ca21ded8e6491a8e5ee0c3643f2d301f51d4b4dcf8f
MD5 8c57b99980f41c5ea0227ed7cb311347
SHA1 b4dfb77e9a6dc3f6aea320fe0ed069a21419100d
SHA512 d776895dc7f3b59f8118838dcca0cc427a2e3e61351831cd5f78355529a6fbb51d98e7228439227cfbbc20b1674a33a176c0cd873d77f273feb037785cb0a51b
SSDEEP 96:nqk/x511/6mwpvWMoiVmde3+mzE1pn9Er7XSN21notUWQyV+VD7AiEwb:nqkff6mGWMH+mY1pn9Er7XK2Grg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1ea1c8c0d90a267047c53971cf85cdd61a0ca1adf6ec4acba5eb1fec87dd21a9
MD5 0bc10045444edaf7b182432dc393a8d3
SHA1 6a8e80e7300603df030387cf58d73eb420a96264
SHA512 c51f5f258e387fc0eb49cf37b5cf6cd598fa12c7fabd4a56193f1990d42a9910f1279ccd26063a214808c8b97e9add5a0fcfdb2c65725a4f8e617bd2d846d6f4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3je2RUQSRs03z2OMDCRHq+:A9iIxuERzA83h09RZxYjgG0aOMWRHql4
MD5 SHA1 SHA512 SSDEEP

Submit Download