5d46f53e0d857bd318c75ecf1c2f8bfd3576870c653a35e489bf538f14a61cc0

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9110787b32c82aeb54544c88b39ba60d_JaffaCakes118.html
Size 60KB
Sample240603-j16wlsgg5x
SHA256 5d46f53e0d857bd318c75ecf1c2f8bfd3576870c653a35e489bf538f14a61cc0
MD5 9110787b32c82aeb54544c88b39ba60d
SHA1 d8be924f491379f37c891995ef742690befc88a1
SHA512 ea38575dd384b807582709dd599d0bec6f4e086983450ebc341b13cc80fb81342317afb26f466a9896a31ec5c6280a5214f4b2eae71035eaff61fb18edc82e74
SSDEEP 768:hgOriWNcaSoXoHkcvZmCOOcAStyt43N2wWRXRce:WYoJh9OO9t43NYce
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
1168	msedge.exe
1168	msedge.exe
2980	identity_helper.exe
2980	identity_helper.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2328	1168	msedge.exe	83
PID 1168 wrote to memory of 2328	1168	msedge.exe	83
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 1016	1168	msedge.exe	84
PID 1168 wrote to memory of 4860	1168	msedge.exe	85
PID 1168 wrote to memory of 4860	1168	msedge.exe	85
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86
PID 1168 wrote to memory of 2844	1168	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9110787b32c82aeb54544c88b39ba60d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a47946f8,0x7ff8a4794708,0x7ff8a4794718
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17710899164805511321,8464907777013464248,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 44KB
SHA256 6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce
MD5 23536ccfe05b737ae639fe63ee4cc435
SHA1 6d2e9822835dc3e6117a4d2addfc8f241fbdbc82
SHA512 f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d
SSDEEP 768:feIhQcf4fkrTpidkiSOT+S2k9j3ulT+qZcOkgaONCHLex1RiZW+s9Ux9J6:feIhPfkgFiiPk9j+EM5XCHLex1Rp/UxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 396bfc379ba867288df97737857f26dd2be77e5c17cf3b7bca8e16959e03095f
MD5 b48f425e9182f34bfd81a675d419bbc5
SHA1 0e7a01a73fe4292a05d1cd3094eafdba294f2605
SHA512 2d2b374459b282d90ffd235cf0986a2011058b53a6563a0e90355acb7ace4a1a3d1e398ffa8cab01962e27c994fa17925e590df66790925e71fb5175401f1962
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 857af0162e385250170168d2d3b43f98623e322fd98bc1e55d522712a688c54d
MD5 50fbd209914ff99dfdcc119167b52a17
SHA1 8de424e1a71a593031e5c03feed2caf070783d68
SHA512 aec189236cb7e0a6245b8a8f9b77ace1dec2c8c525e89530d9477dd2d60bdbf0d6fdae9343aa9ce91bd34920df2de5f78e896d42948cd178e181100be6aa669d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 c4089e063e6c86103bc832e87e66072db055eecfff02662f4dae632d86e4b0f5
MD5 3ead20b6874b7a02d3fcbd5cf94dfae8
SHA1 ccd5ea89aea54909dd4eece90ba14c8e9ad77dab
SHA512 4161a9f74a1fcdad8bc843ba637efdd947afff30d6f199bfc5f5cfbc2d312e8bd266d0854dfd181a9afe939d3417b003c44462494bcfa1f8c49b7a917d95476d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1b16e7d545f262ff837fa16e05c83b3010c821d786c20022e4839eb82663ed59
MD5 a5d7a1011001384c35689c8304162bfe
SHA1 a91ebd7c8ecd964990d9f55cac4cf99a497e459f
SHA512 d2b23645e6098a251ad1fd270b228644934928e0abb6857fbb80b454a945bc8d0182553830c8c9d71a920498553c5c4e66835876624a107b147e0c357e23ed0d
SSDEEP 96:nnkfF1Av1wpvWMoiVmdeHBrz/1wZUWQyV+VDCziEwb:nnkta1GWMXF1wZro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f383cd0cf00b8fd4d10df7a74e26f5747106582fa1b69d6185bd256b5ed4acfe
MD5 2f39babf8786e87d324e1483c1a87d03
SHA1 57c33f95a6d49bd89354a36390afc47d79287aa0
SHA512 08f235fd1c626eeadb9cd58708fc0346efddfc90f63044933b2e8ca07f1e7e48e360466dbbd592f1d4063a6964aed869ba2556814745405aa990ee01b7d48343
SSDEEP 96:nnk6F1Av/dwpvWMoiVmde275UeXDi2Brx/1wZUWQyV+VD7AiEwb:nnkya/dGWMG75UeXDi2/1wZrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6a14ee7f3f616c1432f0e0a58bbb503ba6f577da06b8804fc4f18cf0ea4a4afa
MD5 eda1fef5160529cee8305b97c678353a
SHA1 4c0edc242ec859fd0bac8bb4eeb80c475c7a34f0
SHA512 d3292f556f62c9d13248902307f8802f59ebf35540dd1900034c8fbe2bcb25afcad188db6c0871635e260c25a9fd2109ffad8f2271d7389d77563c0d87c527ce
SSDEEP 96:nnk6F1AD/dwpvWMoiVmde275UeXDi2Brx/1wZUWQyV+VD7AiEwb:nnkyK/dGWMG75UeXDi2/1wZrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 19b1e490d8f87c7154e8bdb9ef90f101ed6d7c42c6c707c2f6268ab7bc1636b9
MD5 bd36743df0e83a09989d3e8c13f3c95f
SHA1 a4e233a802c814e9217957e1656c7d874e8b7d0c
SHA512 2fc7688f06775ff4508aa1b9c2025d88f00f5120a57a87bbd4462cab1c6368d17304298a4620e9feda3753af24907bb71a7eecf4086dc4710a5af52969cbeac6
SSDEEP 96:nnkWF1Av/dwpvWMoiVmde275UeXDi2Brz/1wZUWQyV+VDCAiEwb:nnk2a/dGWMG75UeXDi2F1wZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f0b0cafad602fffbb8e2e3c358a8f5e522ab51366cca50efcd1d9fa9296bfb46
MD5 59a85bc26e98301a3e3954c652f21803
SHA1 929c3d3536dfd50460c76dab0e017a8db35b7103
SHA512 590cc4801426d24dd6742eb3fa10354276463231e077801e2b935ff55b85eedc967a364d69b75efbdb5312a6025f3ad2db743e237656709d1434f0240e9f4fc3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupuueHke2RU3LCMC2c3z2OMC:A9iIxuERzA83h09RZxYuueHKOhdcaOMC
MD5 SHA1 SHA512 SSDEEP

Submit Download