b8896d62b5bca4dd07d52608b24d90181b30c0cdfbaae5b2b2e6f0f6a1f0b469

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a37dfcd9056dc1257df9dc06fd8c61ed_JaffaCakes118.html
Size 57KB
Sample240613-ckfadsthrj
SHA256 b8896d62b5bca4dd07d52608b24d90181b30c0cdfbaae5b2b2e6f0f6a1f0b469
MD5 a37dfcd9056dc1257df9dc06fd8c61ed
SHA1 bf8bdf604fd6394e29f1a470ee2f34c3384d506d
SHA512 f71c1d340bb74ac3064d293ac9c7e6e2b1d0becb0cd1b3e16d73f5cf45da7426a13d3ef8c017280806736a06d9c712435bf056d0267bf38e21a08e5c12fb97c0
SSDEEP 1536:5zmZQmTbT75F4OOxGj8Ew/7u7Dua/ehxB8BY/5JXixRYCY1u2XfMgfttcj2ZzmsR:5ijbT7P4OOxDuexyniXfMgfttcj2ZisR
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
3692	msedge.exe
3692	msedge.exe
1172	identity_helper.exe
1172	identity_helper.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4760	3692	msedge.exe	81
PID 3692 wrote to memory of 4760	3692	msedge.exe	81
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 2632	3692	msedge.exe	83
PID 3692 wrote to memory of 4640	3692	msedge.exe	84
PID 3692 wrote to memory of 4640	3692	msedge.exe	84
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85
PID 3692 wrote to memory of 4180	3692	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a37dfcd9056dc1257df9dc06fd8c61ed_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbbd546f8,0x7ffcbbd54708,0x7ffcbbd54718
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,10084130562553893478,2626857957716750345,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3408 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 182B
SHA256 a97fb78f7350d3dde3804344efb6c1af5d481ff259d8c485e8cf8c4851ef87b0
MD5 4e6156be729a4f65681a10847e3fbf09
SHA1 e033f0e00b5d0dbde58a987a4383d4d99bf7a981
SHA512 9767982ea89f85cf77879d14e11d1baf5ea0b0da1fe499a5897f30c966f4cd94368d93bd20cb3a2dd0ffa74c8957a6fd7fffe917f33c221edacf24b0be13e0d1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d0dde4ac600f7397379249e709311899348e1e85f827daf29ab7bdf70ec00cb7
MD5 656940658562420b2acbb049214899b7
SHA1 6553006f5347a5a81899f5bcd88d1239bbe80946
SHA512 1fa85d976c29271886d80092c1f3cef78daf3ece9aa75fbdd83eec53c95e5b40a61267c79d1cf0d3c0c507d68e634cb867f09e57775dce308b01bdcec01812e2
SSDEEP 96:nWk/oxm/Dnmq81hwmwpvWMoiVmde1721zoCUWQyV+VD7AiEwb:nWkBCX7wmGWMF729rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4d0b21fed3285e16a68346d8167c981833672f78d30f5554cb0e9ccb8eef2ae0
MD5 ba5c40df5f0276cc5361f8120906022b
SHA1 91db5c31dad4e8807c34b2f679744f5ae171e43f
SHA512 8ad29c4136259f580b4bae6bd090beb00520ae4ec4036760e7e82f5629996cf4eaa362ea0be9200c66196a9b1fa618f626ebb33a19e5573b04fb7d59ca9647e0
SSDEEP 96:nWk/oxm/DQYmq81hCmwpvWMoiVmdeH1DCUWQyV+VDCziEwb:nWkBIX7CmGWMXsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cada0cea8979c7414991994f74cca8203eecca3a3b1113f60a6bdc526e6fc436
MD5 303e79d11a9775707e0e22a2e93a401c
SHA1 cce3ee9898e201461f244eefa9e14898e7f0ceec
SHA512 5fcf40a7b23d9785ac0633db087cb32e45d7dbcede2b3c63a503aba1876c8b117db34468bad1fe2fc5a1e0d02e402f567b55fdd479dca6b7f9f458db839da8e6
SSDEEP 96:nWk/oxm/Dnmq81hwmwpvWMoiVmde1721DCUWQyV+VDCAiEwb:nWkB6X7wmGWMF72srV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a95e868808e1355581376baaf0b61f901c66d6713c373d231ea8d965ad621c34
MD5 278e42640fef918bdcd09c0c8b2f4ef8
SHA1 f9bbd30997c82cd814a6a97b3f9878a762da0340
SHA512 383be2d94ee9552bb59de586995e284606c26fd8dedf0021038b3db8b8d70fa8d20f19b2ddcf2ae860714325f308abb942f365032b51be54cfbe1221f3688790
SSDEEP 96:nWk/oxm/Dnmq81hCmwpvWMoiVmde1721DCUWQyV+VDCAiEwb:nWkB6X7CmGWMF72srV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 50461bf98617b41678f0f371047d5ee3283501a8a8b9a7b2775ef48e4730de1e
MD5 d6b98df48d3b416a22032a58d7141e1f
SHA1 cfcab74c462255731cfdfba2f692a8e70574720f
SHA512 26e62034140cd3f04901b50f25bfa5927cecac34135b6b24f39f9360067e5feb32043a140c99d71b3af8e82bbdf7153b46dbe3e95a6dc94214cc1446d45d25a4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphOTje2RUBSRsO3z2OMDCRy:A9iIxuERzA83h09RZxYhOvPGOaOMWRHS
MD5 SHA1 SHA512 SSDEEP

Submit Download