b6394c05a5f1662c5d1af0d6ffe49ed525f6391da272463a625e72e28a15e118

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 16:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93e96f24718e5d5c848313c0a94c2deb_JaffaCakes118.html
Size 16KB
Sample240813-t9tyhsvdlf
SHA256 b6394c05a5f1662c5d1af0d6ffe49ed525f6391da272463a625e72e28a15e118
MD5 93e96f24718e5d5c848313c0a94c2deb
SHA1 631965348aa7429df64927d108b57bca8c2a0230
SHA512 d1f0ba789023f699c30b1266ab063aa7746b5fba2099e41a79abe27b99dbd8d085360cc3536175da4b7757dcfc1ac80b53e957a5145aaaedc52951f6e6d46c90
SSDEEP 192:z+h+5jcSwuQPJo5mmPvS9Zei20rvVzYW7jfhEybB8i9nyKO+TglvbvxQtGIylmPn:KKckmsuprNzYW79VekbsRb3J2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
4796	msedge.exe
4796	msedge.exe
856	identity_helper.exe
856	identity_helper.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3016	4796	msedge.exe	86
PID 4796 wrote to memory of 3016	4796	msedge.exe	86
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 624	4796	msedge.exe	87
PID 4796 wrote to memory of 3428	4796	msedge.exe	88
PID 4796 wrote to memory of 3428	4796	msedge.exe	88
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89
PID 4796 wrote to memory of 2604	4796	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\93e96f24718e5d5c848313c0a94c2deb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc5946f8,0x7ffcfc594708,0x7ffcfc594718
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1576,5845770765191037222,9936796461329072126,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
MD5 eeaa8087eba2f63f31e599f6a7b46ef4
SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
MD5 b9569e123772ae290f9bac07e0d31748
SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
MD5 SHA1 SHA512

Submit Download

3f61853f-1e2f-4c2b-8e7f-b0fc9978145b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f61853f-1e2f-4c2b-8e7f-b0fc9978145b.tmp
Size 6KB
SHA256 bc743abc688dbd7c1dbf9d04e95c8693bea3f73485b9503910cdd4d4834872bd
MD5 ac50570f5d508dda7123f26def0c1112
SHA1 00c4cfe9c84ad5a1afbc9c4b1011d7d19cbb2eca
SHA512 95ac731a4d4b0728b14f8b2ed40fcfa63b968e349b5ffaed00dcfadabad4c821765066c7505045d78adf9e8637df9dfbe15bc074ada482d39eedcd79df9afdc0
SSDEEP 96:nvkzDxm/LQYmqAY1U16wpvWMoiVmdeHk8NUWQyV+VD7ziEwb:nvkzwAQc6GWMXvrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 210KB
SHA256 04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
MD5 48d2860dd3168b6f06a4f27c6791bcaa
SHA1 f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA512 172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
SSDEEP 6144:841Spcz/R+SPtJWSzfNE8VJBThCtc1wLulygOG6UlwJ:84aczBWsFRVJBTLEupOkwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 d739b56d8a0b91feaecdfab70cc3a76f2fbcc320fdd613c3a6b017325a7d0452
MD5 3600b90c91b9aa02f5457c9e85204f82
SHA1 4c112abd535e5ba56db432189b4022d77be53256
SHA512 029047b5d3727f012eece830f013c725419f45e9cd7f38df9db25a7ed32ff4ef36f87ace9905b8ad2ab9e88ebb65362f1f7a637fd15395db7e5a39d687211560
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 884e3703665847b882affe24d9b523d94b72213a7771246461f14034013f6de9
MD5 d47fc635184d57b4a4a544be32115427
SHA1 999c4ca26a0795725711304caf820c4dfba787f1
SHA512 f1ccae4cd8b420b54ff511515a91c1704f05d64dac3ca3ed3d852103bdb671d7c2d7d2fe4aa53c7a6561bac8b58bf5024821efdfa5b5581e87dfff62d862690f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 71cd30fa6ebe6e46d60caa38d176e558bd33aa587c51e874e6f78874609f2a99
MD5 4d0d1460e6a2ac7212fa963f03ca80b7
SHA1 9979204e49a27994b315b1a149dde6d5b4f5efe5
SHA512 ab881a4eae2b2c7bd93d34d0b70b2b5840449a12bc65bf6d647b43a414aa47770c4bdb09174d2220269e60ab3fdd880fe7b3241170dd17c1b0d5315b1944a825
SSDEEP 96:nvkzDxm/L6mqAY1U1qwpvWMoiVmde3Z88Sm2k8NUWQyV+VD7AiEwb:nvkzwFQcqGWM588B2vrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 27519da0a045251774e8898498846f8802ad96640397d006d6316d06b1c4b8fb
MD5 3f5960e9204b2b191783806694f7c156
SHA1 bc300d2384cfc82a2b0f04daad179f55c86df645
SHA512 f1ed6b8ca35f3b785e1e80f552b696d9eca8c3f9bb27c307f349e45b9291dd1694d3120531e1d8254a324b5398408533d16789e35620d0f645261cd92238cdb6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupse2RUYYxn4ru8z8ZJvEP8:A9iIxuERzA83h09RZxYyM4Pz80P8
MD5 SHA1 SHA512 SSDEEP

Submit Download