f00cb67872fc255af42774613afd532df452dedce635a2fb87699dd6856999e4

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a59101913502518b6971c9f4edd46773_JaffaCakes118.html
Size 65KB
Sample240613-psl45ashmj
SHA256 f00cb67872fc255af42774613afd532df452dedce635a2fb87699dd6856999e4
MD5 a59101913502518b6971c9f4edd46773
SHA1 62ae9033cc0b507893daaaf0173089e2d20ddff8
SHA512 2663668f3b4d816c8e66788d254950eca51d618c16eafbfb9a5997242ff86fc66c6bcfd15ccdb2ea93fa5f855a8ecebea3c1a838c8c82a58349dd8e3d90157c7
SSDEEP 1536:OS2i/juqQhtmScJKOvyfDhmjw5A0bIFe6WErUJ2EwegRVL4cntKRZUxmUqNbrZSg:OS2iKRcJKrbhmjw5A0ZgfntKRqxmUqNx
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
12	sites.google.com
13	sites.google.com
14	sites.google.com
6	sites.google.com
11	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
2268	msedge.exe
2268	msedge.exe
1764	identity_helper.exe
1764	identity_helper.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe
1684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1280	2268	msedge.exe	84
PID 2268 wrote to memory of 1280	2268	msedge.exe	84
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 2656	2268	msedge.exe	85
PID 2268 wrote to memory of 5060	2268	msedge.exe	86
PID 2268 wrote to memory of 5060	2268	msedge.exe	86
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87
PID 2268 wrote to memory of 2396	2268	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a59101913502518b6971c9f4edd46773_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd894146f8,0x7ffd89414708,0x7ffd89414718
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,15875356745157695471,7818640123130420191,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22
MD5 257c0005d0c4d0bb282cb470925e4376
SHA1 f9b8efb511ed64292568977c9f2ec255509e8f7d
SHA512 2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c
MD5 4819fbc4513c82d92618f50a379ee232
SHA1 ab618827ff269655283bf771fc957c8798ab51ee
SHA512 bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 c088db1a02410b77d96526cff91c7644eb2eb27c07403119c085a9971ec369b8
MD5 26d3b1a0baf52b552a567dcc03c031a1
SHA1 9ade19da2ee7cb12532e5411d39786ede7b81a82
SHA512 b088cd908d5879bf0bac84548362aaf6503cbb26f944bb75452019fe3d779b4d1bbcc50e6356dad7ab95f7f93dd92a4d707a2b128a3df97bbb3d540fa3e937b2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 49e93b46629e0a9d3e7c55dda914c0f4e8929995c2ca3eed72a23396a7f67299
MD5 cc3f1d2b0b2abb914ae01d3a259f88cd
SHA1 cbf2b6d43659e6de3744a112f048b7e313acf842
SHA512 1600a5db77db9733b2659d7743e94b3fc099e938827d6d52182a5a6126037f3da37bc570bf3af36b5244b12259460c319a740317b5a5f099e293c3fc7ff71585
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 e9b6699bd834da38ef02806308195f14ecd36d3ff7e0df7778e0bc3f8bc01c02
MD5 54bb294f32b9e4c7bdf158f1de16e805
SHA1 f255b8412aee56f8027b96dc63e2c6502e92a89c
SHA512 534dbd48a5cce8dbf018ed2a83eb59b5d2e144009f3d2ec0e0b21b2ac6d7ec4bda8d31c7ce87820fc301f1e5bfdcd995ee44cca0abfe686227f6f882a3a9af36
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fc73196d5e3d42ad45850084e812098d08b3ec3b2b7b6938c08181941fe50c5a
MD5 829b1276b0ba2d8db60499daf83d8917
SHA1 e585b497e6a3d5ecf25ccace741d1ceff8589f17
SHA512 f3e3f4e281569252961bcf1488e70722a7241bb1ae9af063a33b9eeffa1816634da7007d42be5a574a55c00a89dc47835d64ad72a03f792c830e230a53622b0c
SSDEEP 96:nwskIYgm/DQYmqAm13ZwpvWMoiVmdeH2WfVt2FUWQyV+VDCziEwb:nwskRIBmFZGWMXFt2Fro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5327af7374ed2c2062cbb60976faa789c4f0ebb87cf0061d65ee6373720f0032
MD5 a1e262055af4b0a0a000443d6ad3a153
SHA1 1f953cd124da01dd6534c6171278817ca2119dfa
SHA512 d0c40e0ee30b6e995ea71f9f791c01b2682c670fcf650d704b05b812cf4812524e1229162674dea808670a3769ef78aeb9d3f9257a3493d98d480e07ad5f26fa
SSDEEP 192:nwskRCBmFXGWMf6vBS+SSN5fMlfprFM2Ft2Frg:nws1mF2WamAroFwxBdt2u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 489afe913269faacb05b0c2d0fbecd7b9b3e0d8295242d1d28270ccf106827c5
MD5 895b3dde8b86b915e188a064b6cb5377
SHA1 e778a0e24d088a3e25264352b854018971bfebfa
SHA512 ac4ae7021dce9f1027466cd21dccc325d1acc62a33de596c7b8364db91cddc09803204a98913d174ff5700edae3daee9c6aa29f85a21b77480915806a037fa11
SSDEEP 192:nwskR6BmFZGWMf6vBS+SSN5fMlfprFM2Ft2FrV:nwshmF8WamAroFwxBdt2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ba3e777de79e0ddc745e6cd949e51bb2535c7e80a0d6218a7dde56fb67e75153
MD5 0c01857fdfd3adb2118ae3463c785ea0
SHA1 a8dda8d6178eedb6e6d9a9bd3d03d111bba890f5
SHA512 2e4d3b0dadcd9d6e96775a49ae039bf84191a069cc22b3ba175b549a40144e93c9ce1b3dad1ea1a2c5b97aaadd29f7487903da007ee8ebeeb182f214fe8e9a84
SSDEEP 192:nwskRCBmNXGWMf6vBS+SSN5fMlfprFM2XKt2Frg:nws1mN2WamAroFwxBfKt2u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9
MD5 95cd1581c30a5c26f698a8210bcab430
SHA1 5e8e551a47dd682ec51a7d6808fe8e0f2af39e86
SHA512 e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece
SSDEEP 768:ntEW/l8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHLlj2rUr2A:ntEW/lu1ja2L/rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

e54fa692-2d83-45a7-9376-82e0c5411540.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e54fa692-2d83-45a7-9376-82e0c5411540.tmp
Size 10KB
SHA256 0623ca1135a728ae1e97d2667cc1688afb1e983d2e8a128aa7abc7d8da965980
MD5 f8df2a4418da4ab388adc5b78c7206e3
SHA1 53fc87ca08b82191b30af9391c9c1da44a0fa9af
SHA512 89b57dba5ae3c5f8090fe3a0ce7f3fb99890bafa5d34f6a5d90c6d1cfc4756a5b6ca66a8ec2f7ac9aee12f8241c5b1ddd3be67d42224550813da8d14a8ada54b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupoHfcQ+e2RUmb9nh/R03z2g:A9iIxuERzA83h09RZxYKEQgjJtR0aOMM
MD5 SHA1 SHA512 SSDEEP

Submit Download