1f6036748ff4f5727e039ebb447f4844fa64f464ad0bc77f99e6bc9f4296a53e

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1ae27879bd96f87cdf5e6399a730776_JaffaCakes118.html
Size 424KB
Sample240612-wtngxavbpd
SHA256 1f6036748ff4f5727e039ebb447f4844fa64f464ad0bc77f99e6bc9f4296a53e
MD5 a1ae27879bd96f87cdf5e6399a730776
SHA1 f62d5a8a9b6175bd08ee44476f1ec2d813a4a85a
SHA512 53155fc62fcecb12a2fccacb3172f4f6bca294b771aee1f84e579b14a55eb3694f768e0b5cb87346387763b8cdb32e4869d8cfb8ea95a1b1506e94da422be8b6
SSDEEP 3072:o+Y2MYJ6rHfgaToXdYKOumXl74aitOp036jNeQIHHS1Y07BKMtIL:oBoaTogJSswQIH1n
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1540	msedge.exe
1540	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3808	1540	msedge.exe	83
PID 1540 wrote to memory of 3808	1540	msedge.exe	83
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 4780	1540	msedge.exe	84
PID 1540 wrote to memory of 1596	1540	msedge.exe	85
PID 1540 wrote to memory of 1596	1540	msedge.exe	85
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86
PID 1540 wrote to memory of 1788	1540	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1ae27879bd96f87cdf5e6399a730776_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe542a46f8,0x7ffe542a4708,0x7ffe542a4718
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11579962528638207064,13650484122631838325,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5516 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 09be86b902b47bb6233d57476d4069033bb93e86f7b93ec471a524cbc76f2023
MD5 262cd2cb443ca8ef937eeba8ca0b7878
SHA1 a4e6d8d3b5e06c7726e65e496cf0855b3f7322ff
SHA512 949d2b8147e2b92d88f11cc7634727ec1d76c4aa7a341aa42789805762be85e36e9367cfc4339a26a7f5c8d4466c557c4736b03c404288bae4656f26054351e2
SSDEEP 96:nDkDO1Cn2wpvWMoiVmdeHk4lUWQyV+VDCziEwb:nDkaon2GWMXbro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a2e36f00a22c9e1870583c5a82c65b960937582f5c122cb2418068e4abbef507
MD5 c80378492771f1132371ea6487afd451
SHA1 e253f55849db0b62979f82844dafc017b08d28f0
SHA512 4a80930b4110971ab88c4a46770333a3c53bf29a8a337fcbb580917e645fe7e1a1ea2c37d442be88750ab86ed583a923bd26d0a7b795e349bc5b34cc70798ba2
SSDEEP 96:nDkDO1Cm2wpvWMoiVmdeveR69k8lUWQyV+VD7AiEwb:nDkasm2GWM/eR69Lrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e9e2dab863bef80c6e51ccc7364f841f86b98f486d40d15c740cb0545204ee63
MD5 82228519adbaa39476e75b0a26def1de
SHA1 445fc14c75261573e8d8af9938671557a78aa753
SHA512 59c85fb07cc5564a80e23b2a38d92a34435281eba5ffd3a42949eb7795b909a16f4c0eac71725f99e640786f7605044d53ef8d256bc50c316102b0bcd6d18bce
SSDEEP 96:nDkDO1CX2wpvWMoiVmdeS9qpZ9k8lUWQyV+VD7AiEwb:nDkasX2GWMiEpZ9Lrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0d9006ceb2203628455672ee34af4ee469ce942de9037a57383fbf08411fa401
MD5 45f6cba3e2b03a71865e0816f766b316
SHA1 6ca77a3a1cff4bb6f360d6f8d75376f6c567bc8d
SHA512 afc8c0ddf8d47c3a15c9ea47313041c3fc0ab689d25a33cbf28fd0459c167d97802038f80c7262fceb84daf0adbd4cc17f0cf994335009513942398959c68cf6
SSDEEP 96:nDkDO1Cp2wpvWMoiVmde4Ls+7Mk8lUWQyV+VD7AiEwb:nDkasp2GWM6s+7MLrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d6091cfbe6415332dddc6c4ccab858d31e8fbb6066c468486a5c5e276d0b76f1
MD5 ae47e9f0bd29f2d10f673846e12bbfdd
SHA1 b8ecd925b69bd7249bfda01abe94bf92b222457c
SHA512 b96180238ede1a489c5b375e2c87f9f53858dd84dfb611f600268368cf2f04f9f2f59e01fd70ba07a2d15b6ea1f361d1ec5e65f16116acd75f03ba111006a5fa
SSDEEP 96:nDkDO1CX2wpvWMoiVmdeS9qpY2k4lUWQyV+VD7AiEwb:nDkaoX2GWMiEpY2brg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 955c6b0b5571336e28f65fced42a61f7098602ca4da73d2f5906a654130d92fd
MD5 013cf1b26436a72b02fe6d8ff68f6f59
SHA1 6c14ab39aa1da6c94e2e555398ed51810ce41c11
SHA512 2e130afb273a9823f88514a35150b234da79a2433feecbe11b2303aba3f9c017de44027066016f41d1721c940fcf4eac038d758b1401ed62cad58bda401f27bc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupd3e2RUcyRV6:A9iIxuERzA83h09RZxYhY6
MD5 SHA1 SHA512 SSDEEP

Submit Download