aa7ef431266e9b8d54814a442b18834715ad92ecf18593a2d414105c4883db47

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b17b99e56919be973504ca139120898c_JaffaCakes118.html
Size 79KB
Sample240616-dmtq8s1dmk
SHA256 aa7ef431266e9b8d54814a442b18834715ad92ecf18593a2d414105c4883db47
MD5 b17b99e56919be973504ca139120898c
SHA1 a45d0cc518a545b5ed1598ab1236b4c12b3d3da3
SHA512 5b34fe1a159b394b5c8d8c652659e83112735ab229cb700e53c9dddc0b5835ad8fcbd078c796b81b759f70e9249bf63ffaa8351c05115968299c542c13d85070
SSDEEP 1536:OTgZNpBqLIdcAzDR8jlmVef39SjBu4PfxL:OT8pBqLIdcABOf3IjBu4PfxL
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
228	msedge.exe
228	msedge.exe
3372	identity_helper.exe
3372	identity_helper.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4680	228	msedge.exe	82
PID 228 wrote to memory of 4680	228	msedge.exe	82
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 1184	228	msedge.exe	83
PID 228 wrote to memory of 2816	228	msedge.exe	84
PID 228 wrote to memory of 2816	228	msedge.exe	84
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85
PID 228 wrote to memory of 4732	228	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b17b99e56919be973504ca139120898c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfd7b46f8,0x7ffcfd7b4708,0x7ffcfd7b4718
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,14300583273363059981,9955772582820880761,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 44KB
SHA256 6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce
MD5 23536ccfe05b737ae639fe63ee4cc435
SHA1 6d2e9822835dc3e6117a4d2addfc8f241fbdbc82
SHA512 f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d
SSDEEP 768:feIhQcf4fkrTpidkiSOT+S2k9j3ulT+qZcOkgaONCHLex1RiZW+s9Ux9J6:feIhPfkgFiiPk9j+EM5XCHLex1Rp/UxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 4c58bd692ee65bc81ed3997677384601347acf4c2ce71eaa204f07575ce9017e
MD5 83dd26bb373b67b9617672dca349ac40
SHA1 6aa68509baf300abcf0f4a9922db60716cbdb508
SHA512 500b314d685e36360bf3b1fd4b7eef6c8a02c8495819467c1f9ccb908ae5919c04f584cf75af0557a5d6418b196797f82b0ae6530832e984282ece336eb465d8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 55e3b999ebb1e5148c1a264c0cb475e4c2950e99b050919fe1443b073000134c
MD5 67f857600f3d0e2009edc5f450c0d2b2
SHA1 9a23e7290d9a74ae0acc0c368d915d77b295596b
SHA512 8623aeac314646a010e953f19669aa4e49a697fe9de3db76510e32abe11dc51f2413dabc4617201e236b53dc99bda8d53d0eb0d28a73f57d8c4e85a49af28a74
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 dcdbf0f984455b34a0a4eac77a329b49b710940217901f09fcb26acdadcb184d
MD5 45ffc5553a24b6ef7321b37e665d0eb0
SHA1 bd5cf3409776f0ec7d0fa68362fd1cde7813a948
SHA512 06d689d74e66ffa46f8b7c7c01f2c2d3a1b851f60bfc405bdc87278e0c3de378a0fe65d5fd62218a9ea8ba02bdd808b61571fe5db4a5319ad79c5ecbd4890081
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 4b46f621a3f0ebbc4aa635f4d0dc405bb33500778f07170d89bb8544f9ff31de
MD5 255d244b4efe16d38f11470509e51636
SHA1 0d8044e392d27b769c840470f1b8b5e82e7d435b
SHA512 047aeecc7ae1fc28d1bb20584e84e4126986d4d7f4795a916b740451cfb3643333e5e63049dfa58a2707808c75fc31af7ff761b7690c690f35bfa1c7d617a18f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 cd3ed018315a6a085200ac7df0b44088388eed4b9445de9560da717e589ed0a4
MD5 50b455ff5f51770424241a6287b04da6
SHA1 1b1abc8b193c99e4041ec32acfac161b1874278f
SHA512 4f9d140bc99f6f71caabe012fdc419f4231ac705ae2f186523b5d84af56ef2381204285717060c4f1456ea7d7fe8003c3ce468d54f56febcc5be3466e7f55d1a
SSDEEP 96:npkVoxm/Dnmq5L1v8mwpvWMoiVmdeweRCt6ftdAZzhn8yZ21DxMUWQyV+VDCAiEc:npkf6y18mGWMAeRCt6ftdAZzh8yZ24rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2f5af40a7347e8bc1504504a73ca38195a16f3af7c248be5d2d7d30d6b5d1477
MD5 768edf473c521a6f42479734fc3b838a
SHA1 d5c321d3c826b7b5ccfe7b34b8ebacaaf642c2dd
SHA512 0826de17da29e71785a1ecaead9d890b57fbdb96fd5c1890f20acd415ddf12481aee857e8d7fc3767a5caf2c46e9f7bdf518d988339e17fbd473746b0568e94f
SSDEEP 96:npkVoxm/DQYmq5L1v+mwpvWMoiVmdeH1DxMUWQyV+VDCziEwb:npkfIy1+mGWMX4ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 c63932d0ef198634be87d4ec289cb65de0559c1ef5962526c43c850e704d8f34
MD5 57f9009808eb6056bd6fb7ec40d16cb8
SHA1 fe7b7be42150ff9fa8bc43af6fc53dda6ab3c908
SHA512 f3ed00c3b9a885e47bcf6503413e2d8559877854820bfaa38050a516d8f1873b1ae594ae47f1c2d929a371d82a09d952cd2df29989dc26068f1487f0b17df5fe
SSDEEP 96:npkVoxm/Dnmq5L1D8mwpvWMoiVmdeweRCt6ftdAZzhn8yZ21fXxMUWQyV+VD7Aih:npkfCyd8mGWMAeRCt6ftdAZzh8yZ2Yrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 378a275b45ebbe5d52de002c0e007f0e535271d1ccfa4f13f77a6a0edf2ac47f
MD5 d154d72d2b25786602874aec80038422
SHA1 49810615384265a4f38ca71c313d4865847f1410
SHA512 ca5c220f0ba8894dcd32ccd5ce5d1175a6834eb934c0e9bd22caa9fea922c838bfe5fb3548a8b1c719aa2a2a942a0f10c5677a6d215fda4194b37a0c718247b7
SSDEEP 96:npkVoxm/Dnmq5L1v8mwpvWMoiVmdeweRCt6ftdAZzhn8yZ21DxMUWQyV+VD7AiEc:npkfCy18mGWMAeRCt6ftdAZzh8yZ24rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f0270aa38038f4227b57bfc628790feb961002f4fecc57d7175e6dfea80bec1a
MD5 e36d3816b526f9db46dc691a1f38838b
SHA1 330aae9ea73d3d00796a84d729830858fbaec0cc
SHA512 d1ab2196b8eb0333cc35815a34168329391a6a2657c45a19c8123d08d9130f95b7f043204a45960491bf46db315e7a05546cc51cf3edafa25234e4e04a363cc3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkne2RUpSRsD3z2OMDCRHq8:A9iIxuERzA83h09RZxYgLGDaOMWRHqlK
MD5 SHA1 SHA512 SSDEEP

Submit Download