d3d19db3bf542dd45e8e6a6bb764b1496bdab7395df46c74457d8f7643fc1b69

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2589617ae260769b2d8a55ec1ccef27_JaffaCakes118.html
Size 213KB
Sample240821-gqzcnsshmc
SHA256 d3d19db3bf542dd45e8e6a6bb764b1496bdab7395df46c74457d8f7643fc1b69
MD5 b2589617ae260769b2d8a55ec1ccef27
SHA1 3a990037d5edb4002e5e32aa733320ef660f8771
SHA512 92b93a39be6c7070062a83cceb68693f1ba0af4c8bb6cf11230cb331168c733e164b3af818c3edaad59ef89301575720ef8a72e40c7113ba8046cdc4f4f6188e
SSDEEP 1536:PuztRWsTe4Mh8w+qE2BHx6y1T0ime5ZQ5YteE/uKJc:PuzrdPw+qE2BHx6ArksuKJc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
840	msedge.exe
840	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
3684	identity_helper.exe
3684	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 4288	840	msedge.exe	84
PID 840 wrote to memory of 4288	840	msedge.exe	84
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 2576	840	msedge.exe	85
PID 840 wrote to memory of 1028	840	msedge.exe	86
PID 840 wrote to memory of 1028	840	msedge.exe	86
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87
PID 840 wrote to memory of 8	840	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b2589617ae260769b2d8a55ec1ccef27_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e8a146f8,0x7ff8e8a14708,0x7ff8e8a14718
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1460 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,5378479397697068493,17851055842663243476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
MD5 111c361619c017b5d09a13a56938bd54
SHA1 e02b363a8ceb95751623f25025a9299a2c931e07
SHA512 fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
MD5 983cbc1f706a155d63496ebc4d66515e
SHA1 223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA512 d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
MD5 SHA1 SHA512

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Size 21KB
SHA256 4ea6b3a39d794db93d1084770cc340272f8e5ffd5cd8d0c05c1f5841e5dc13e0
MD5 c3a1bf5fbff5530f55ad9f9fa464f25c
SHA1 449a621b775cbe1d3ab69c54a0e18c0ccf6d6caa
SHA512 75aa617b33be2eabe9f67166d14939d58abdb2396b9911dc7ba612130d2ba9adfc90a3cc9b6de4dd6cf8731c90f2ca74b7f9cfaf4a9d0bcbf90d03c907e45a54
SSDEEP 384:uZIPLgiXhd+U+WPd0gxWaBRCtabXFtSNnHEURIwQD+BUJpQNozdbXB:uZIPLgin+bGigxWyE6DIHEnySJrz9R
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Size 135KB
SHA256 bea369fc5bdd5b9b473441583c46b9939232bf1f98c1cedf6bc2241c4f5068d4
MD5 cb98a2420cd89f7b7b25807f75543061
SHA1 b9bc2a7430debbe52bce03aa3c7916bedfd12e44
SHA512 49ccede4596d1e5640a9c8e8be333f9c18812d58f02b2b15adb54172df1387439e9dc5afc4ccd9d8f0f75f092318bed68d3cd577338e88ef4f9373de8a07c44e
SSDEEP 3072:v09yvZVdMDYywVB1DKD5q3OYHiB6wd77sX7GUhwUEV:c9y2kywx8sCBu2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 2b6e9d5651f9337cc6b0fc58f05f023c8b812ecf2805a9d9144791076f314004
MD5 5ff2ac141e9cdc3d874ff70b07274d8f
SHA1 fdc42f96dbd29916b5fa6e751a1aa33abc8b64b1
SHA512 59fbae924066a772a2a373529249eaa22f307756e4c724888c2186c06193fa0463eb15c8658f31f31b9b0225fdd821e9f763c4ef5222064893f9009d92a9cb76
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 75e0bc108222d5eb8e45b4ac128e69ad165729c08e40896d0d725345fc454e7e
MD5 1834e88e04f6d26f7c23de87dad40238
SHA1 c2b8c45be507addc975c264071e0d54494232bee
SHA512 e3912bbb53d36f8437510e8bb2a06a4f3f2a3a76d6a36e069ab403cd93bcfb5262255c1f23e3f285b551a537a2d8bad1c77dc3d58d6157bd03ff33a24bff3565
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 424410e20982ccf3de18598726f744a94e36ecfae17a16f02cc0c91dbcf2bf01
MD5 0e032ccfa1bf805651f0401da5ee5a83
SHA1 df2b4fcf030692fef73d09bc97ff5126dac6aea1
SHA512 e49cb7bf2c594995bdb6818f84e6e8c2844ef41d78fc1af9bed3642be0288afdc1e11086ba1d20f043de4b6fc83908b46c1c8f66ad0aa17a4c982da46205f722
SSDEEP 96:n6kzo51ngbwpvWMoiVmdeH2FTUWQyV+VDCziEwb:n6kz49IGWMXUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 330dcecc1547f8c2017786629d554a5f0bcd46dc502aba3e77be14fdc75fa902
MD5 957607bf0a6856f0f598b739660aec13
SHA1 904de2424631c423cf96eba6e25b885c0473b5c6
SHA512 0977bf80857f21dddb8ff5885f3cc68fe700d6c818565911a255d002c14701f043e30ac4b58d3f9e0fcf6622188aa5dad044b52c7e6b4999b2606c2a374f57c1
SSDEEP 96:n6kz+51nwbwpvWMoiVmdevDNMVTfVczE+YVTll22MTUWQyV+VD7AiEwb:n6kzG94GWM/DNMpfVcY+YVTll2hrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0192f6cd58f2ad2450a9a98cfc1f186778029732033a072dec39f4a2fb066603
MD5 53e1cc38ccf0d5d65130469635da8b0b
SHA1 680a0d438b59d64af0475e2da2177ecce1911abb
SHA512 6c088a006c1fef52991c2e88807dc420cdcb3e000985eb652193097f9b960a671dcf58c2c4d4dbb2bd2d07f887398c2f487d8732853ef1c72b24b1425a1df608
SSDEEP 96:n6kz651nwbwpvWMoiVmdevDNMVTfVczE+Yl22FTUWQyV+VDCAiEwb:n6kzS94GWM/DNMpfVcY+Yl2UrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4826b9525b65682dcee637186ee2b401d20d632c3b55e85821a2f9d912fafae6
MD5 51e06159ca24bcedd749f754017b2937
SHA1 f13eb22f97f6237f24d32afc1f4cdb9dc1450646
SHA512 d70b10c6a3d642c8094ca36ed992613215362fd95aa8996625b59f25e1c8445510126bf5670844228e7231fa88c37958b53896026ff52c8b18324c1c3a5212f4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupB6e2RUSd6eru8z8ZJhsb:A9iIxuERzA83h09RZxYekePz8psb
MD5 SHA1 SHA512 SSDEEP

Submit Download