c504838f0107994967d9e2ebe6063c5eca1356a21840e6216402211358ee41bd

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4f15410a09f12c4c05ca58bab19a0cd_JaffaCakes118.html
Size 69KB
Sample240613-lwhdkaxfkr
SHA256 c504838f0107994967d9e2ebe6063c5eca1356a21840e6216402211358ee41bd
MD5 a4f15410a09f12c4c05ca58bab19a0cd
SHA1 7df94f14a8b82aba96bdfb993d24b6eff0870316
SHA512 ce8ca7d3af461e57c44730b4d5b49a4cf8fcc0e640cf6c6a70eb9ab1a5f397b182dee8900a0047075e6c36458c4f11f637f606cdfdfbc82e0311fe3aeb513364
SSDEEP 1536:uwgr8VSeO3Jdu2zJojl1UmaaS6cgRrPb/NMhsJ:QeO3Jdu2azUmPhTN1J
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
2156	msedge.exe
2156	msedge.exe
2420	identity_helper.exe
2420	identity_helper.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe
5204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4364	2156	msedge.exe	81
PID 2156 wrote to memory of 4364	2156	msedge.exe	81
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 1948	2156	msedge.exe	82
PID 2156 wrote to memory of 4272	2156	msedge.exe	83
PID 2156 wrote to memory of 4272	2156	msedge.exe	83
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84
PID 2156 wrote to memory of 4892	2156	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4f15410a09f12c4c05ca58bab19a0cd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4612 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1332 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17452580823174023729,2740993397516215252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4692a94c-16fa-4901-8250-294b743e4a32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4692a94c-16fa-4901-8250-294b743e4a32.tmp
Size 8KB
SHA256 14eee1fcd3132766d72252cefb7c5720b9d693adcc9a669f9d1b4fb1a8732eb4
MD5 55e23338c0fb86220f8761ef86199e5e
SHA1 e811f37e70cca53fb87422e66e21ce61daa7097f
SHA512 0b4dd2a23d99ac14e508a63d54b966114153551a98e9ed6ade7d086e6c1dbe7a4760b1c09a8566b68a0faef2bc64a45f898c2a3237b165ac00f31c565c61b82f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfHNe2RUg/Mj2y:A9iIxuERzA83h09RZxYfHJXEyy
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2edfebcc21cc47157bd711f51b2434858887056eaec5468d72c3a62cfad842c9
MD5 09a9f8573098022e6fb206d5910011db
SHA1 2d661472991a7a165e268fd3bb12edf3f6a45d80
SHA512 0dbf4fb7069e9274961b0032e9f98102c1c27a736503ccb10face72384f6a3e1425922ea479146e5190c162e5646cfaa20c327e75c25a60411a3784e8db0eb5f
SSDEEP 96:nFkGN1I1wpvWMoiVmdeHBrz+UWQyV+VDCziEwb:nFkSu1GWMXUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c65e49aad35f98f36ab677036b26a687190d3b8f2e927cd6e9e32c0e446731e8
MD5 cdf573486c278a406f713c867bf43a55
SHA1 c06ab5627bcc80fc291c5d27a50a60c653361ceb
SHA512 12c84eab9e740b1d84ab35e653a912afcd29156f43a9bf1478f21b005967a8d60270d3eec1d35e6e85f8cfc5190354aef0671e7dd3388b03f268e3cbb1a2efa6
SSDEEP 96:nFkGN1MQwpvWMoiVmdeAzYUh9BrH+UWQyV+VD7AiEwb:nFkSWQGWMwzYUh9Arg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2a4a1567c25d9c8a5c3f7a4e03823d7b3dee8dc123564660d714de3c8abaeeb0
MD5 ba9bc29f27c764c0194858ba00cf0513
SHA1 c53751d21a9cc78c23a554884b50131ffb3763dd
SHA512 93913d25a2393479fcfa70bede1b7fc2434d44f2947a8fa543362f5758222f097e0822e49b42ede6b36e5733b440ee22791cd7c3a172e3dc88770f6a29188f13
SSDEEP 96:nFkGN1IFwpvWMoiVmdeA74nne2Brz+UWQyV+VD7AiEwb:nFkSuFGWMw74ne2Urg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 41e221e78e95c0c77f3f14c1ccf11226ee6fe52b0cafe62a8ba3f450c234cd17
MD5 c89f53df732ca23f401301a7671c1251
SHA1 679cdc260fb5e77d2b00dc86f61b965493162336
SHA512 cb326b22bfb0b8308aada6b9189872586e5bd485f4c2991b58bb6bbb9ada44e97fbeaf125302993e09a15634c4075f733ff93adb6cf93d957643383d55fcd8f6
SSDEEP 96:nFkGN1MzwpvWMoiVmdeAkO79PMBrH+UWQyV+VD7AiEwb:nFkSWzGWMwku9PMArg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5b2b59c65277a9974f2f6bde74898bc2dfc8c0b4e6b261d4933be5353f655828
MD5 aadd47f33873d1a35f48b8e1a3c4db14
SHA1 a13adb6ddb65fb66f361f40ddff1b5a3ef8c0237
SHA512 fcd16252def3406607728e4a30a03cf1c93b4236a3df92ffa9b47a21341ca0416bd70ec4e9e50dbe38fddc2f6f335aed2dfecd6360750a5abbec03d7e7a81863
SSDEEP 96:nFkGN1MWwpvWMoiVmdeAZdFdFdobBrH+UWQyV+VD7AiEwb:nFkSWWGWMwZdFdFdobArg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download