8aa6bdea24f65dc82d5d18acbb71e9fd765c048d5912923378b354d8249f9c19

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fbdf8c572bc9122196f1af459e74bb07_JaffaCakes118.html
Size 127KB
Sample240928-j53prawaml
SHA256 8aa6bdea24f65dc82d5d18acbb71e9fd765c048d5912923378b354d8249f9c19
MD5 fbdf8c572bc9122196f1af459e74bb07
SHA1 20c128ef95d6c539921eb46d0e18c51ad827c8dd
SHA512 9290d6fd5181f4feab8247220080fee8587213abdc9b448e6cd60fd4bc56a4a02b75f79212174a6742df632020805673ba4dc9d96491925c29ef90690b9de65a
SSDEEP 1536:1Nzl9KZxjR2zodvhqRVm+OLQh4+JA6OMlEz+2VSntZTVjJW:1Nx9mpmodvhM8DbklXntZvW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
1268	msedge.exe
1268	msedge.exe
3928	identity_helper.exe
3928	identity_helper.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 3672	1268	msedge.exe	82
PID 1268 wrote to memory of 3672	1268	msedge.exe	82
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 2272	1268	msedge.exe	83
PID 1268 wrote to memory of 312	1268	msedge.exe	84
PID 1268 wrote to memory of 312	1268	msedge.exe	84
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85
PID 1268 wrote to memory of 840	1268	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fbdf8c572bc9122196f1af459e74bb07_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff526546f8,0x7fff52654708,0x7fff52654718
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1644 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7405448615027279203,845480849505537619,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 23KB
SHA256 60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf
MD5 2f24e0f5d2c2997a89fb4a8d943c141f
SHA1 99515bde1a5bf72105116ac902ccf3db1dd3df29
SHA512 0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d
SSDEEP 384:VSCKOXcXVC6fizIN66yBc1Ei49Zvi2fSZ886pETkDCm510VS7X+r27Z:aOX/jd6yJiOZa2aZZNAFmS7X+rEZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e6804590b39461bc28335eca3a0bbf411c7460c5df38d41a0e4e8599a8bba1c0
MD5 bd36d9217a8cff548fe5dec13d46e099
SHA1 a2ca21fd1deddcea9f8edde2c0cd4d90f8003a39
SHA512 b5cb3cedc8b3f4107b483984954c8711d5aa9900aa1b8f9bb9f7254fec496d1f93702d6f1ba1f5321dcaaf30fa2e114dd06295674782e85f870f3cfda5d874b9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 52df1565e5345adbd22f896c57ec7834555b219e61d728822b3c723a68a1205d
MD5 d14d5ac4504a000590ad3aae697c19de
SHA1 593f8b878960fb21300622650f9bb2ab84543b0d
SHA512 969b4fc6e049ad744e708294f7eb02a52ca669a6f77f92f519a93bc4df9748678d0c051e5d96d702e5d58bb1b29e7234e24d052b4300f4a33a4ac3d7bbf19c7e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 0abc4fa38244fb1b85360909e9cbd43ff65692bc8399c39fcdefffa7d57f99e4
MD5 1ff4bc958cf5a4efc2ccb8dadada4ace
SHA1 c29b74bc7c32be146ccc7174c6508342456b702f
SHA512 e011eb637cc14ae22d6ee3818f0021bda5e077f888a786e4c59ec37d2382eebeb5a06d5e3dd7cb95b9f491bd06aad4598b521fa990c7e3f01dcb0c40cd089b1c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4404a254d9087b89f8c5795d0ed66f0618b39405160d34beeb6aa3e368dde6f1
MD5 89323c7100d1520d56a5f089acc4afe6
SHA1 4fc182366c8d4a857133ee8b4db71a89c05c34e6
SHA512 6501e9622a37588f5f95da88d8d04bbabba44d66d704bc693bc3515edb80a47379f8eea6c060a46dfd8641a0f6b706cae85989a9d5e15e1c4bb75c86933de24c
SSDEEP 192:n28kzrz6EeFhPGWMbpLfMf0rK61zb2NrV:nVHEqhOWIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 abe8e61f8a1e103662d43f0495000918df912eec4b21690e2426239168c7f28e
MD5 95fca3a2bd0c3b9edaf30c91eaac0d37
SHA1 37a68cc07defb628066a498a07c7cb41db43730a
SHA512 906e141c2ebcd1656ddd5b3cc5f78a2da82a30bb5f8b7b93c4783c59565cae0ad63a94e9bf06a1ebfa0e729e7eae88559ebe0836d3856f94bb0d7c6005ace8ac
SSDEEP 192:n28kzzz6EeFhPGWMbpLfMf0rK61zb2Nrg:nVLEqhOWIh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 281827c1ce9fd9b3ffcaa1975dc0736784acea4a12a1d72d1b29d9360328bc63
MD5 3b63dccd735495c8ff74a159eb23362c
SHA1 0b9c85e0157fbc31d0510f942d0964dc9d11d944
SHA512 8377e71b49337ad97562a3fbf11fe15bfc48dae2e82ee0391df56e71940700daa2450ef1e3dc24ebfc834987438e8a59316d3b41a53dba2bdcb3275d9dfeb67e
SSDEEP 96:n28kz2Gz6114QLSFhPwpvWMoiVmdeH/bi7UWQyV+VDCziEwb:n28kztz6ERFhPGWMXCro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 585ed94b9a928b7700db26a590744fb845b731fd4cc5767ebc0b08f1a6d6e45f
MD5 caa53f02f0286352c33e719787b478f5
SHA1 f75208f605b8b3699322d3434d0813960f811e16
SHA512 28d09b3b914da3df8adc85eff2b90c418dcebe6fd83d9f1421f40234fb2fec8c95f22b1cc38e8c0102bc4c5063e20b82841357aea2e5f4ad074697c2bc32eeeb
SSDEEP 96:n28kzoGz6114QLSFhPwpvWMoiVmdeuQ+b2/bi7UWQyV+VDCAiEwb:n28kzrz6ERFhPGWM+Q+b2CrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 1d9794799d14451f94ddcc260ca304b8e4ea3a85b17cad6cdafd720125f5ed94
MD5 fed14b8b9346d0400e75051515a406f2
SHA1 548f5e4d65ff2102afe436d075c43ed7d6e68311
SHA512 36d52393f1b91eadd6df40fa4bfac4810e3f448f0c9749148919b52daf1f72a0817f622c1301cbe6454965fda8ae5d12253e20f0742d82e38eaa813deabd92c0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiAe2RUhxNXIcM/bo5ZxF:A9iIxuERzA83h09RZxYie0oqZxF
MD5 SHA1 SHA512 SSDEEP

Submit Download