49bad5457a0f21031fdb61aa3e57f89af30c314772133adf6fb830cfe6240da4

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00b380eb7c0f1a661e0b9d49d0ef3244_JaffaCakes118.html
Size 60KB
Sample240622-b245ea1epf
SHA256 49bad5457a0f21031fdb61aa3e57f89af30c314772133adf6fb830cfe6240da4
MD5 00b380eb7c0f1a661e0b9d49d0ef3244
SHA1 d3fef5a943d329b4bb4894c38789f0bfc18a4983
SHA512 07dc5e69b056417d5b9258d2b211593babcaea8ae1dc77e41b5750c057bf6def0ad2ed8ff7d1f6605dcba2e7b2ab65e954f88dc2acdf784425656b276a63826d
SSDEEP 768:SeNqSKw3DtIJNbtADWC5wMpsA9/Ut9ioqVo4CeGGkuuWe/ROqH0HKuZlxjsaIaTr:SuSpxPhiz9owX
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
179	https://jira.ops.aol.com/secure/attachment/688199/failwhale.html

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
1468	msedge.exe
1468	msedge.exe
1004	identity_helper.exe
1004	identity_helper.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4512	1468	msedge.exe	80
PID 1468 wrote to memory of 4512	1468	msedge.exe	80
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 4884	1468	msedge.exe	81
PID 1468 wrote to memory of 372	1468	msedge.exe	82
PID 1468 wrote to memory of 372	1468	msedge.exe	82
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83
PID 1468 wrote to memory of 1576	1468	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\00b380eb7c0f1a661e0b9d49d0ef3244_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc06ac46f8,0x7ffc06ac4708,0x7ffc06ac4718
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2472 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,13976862394989199225,3510536333802765095,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a7807616b1c71c753e8e62b8cc4f3498d9e1c3df8cf54515c4e41e29bf099280
MD5 e443153ce7fed4df3c566aa6aa42d512
SHA1 e679c7f248018d6493dcb0940db6fa82314c2db2
SHA512 e8df632f1c2843c23e28bbc9acd6b909f683b9cb85e5ad072b77a882ac700143d5a58fec6dd461078f3db65404c09036987e87c0a7bb97879cc80cca71827afc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 6c7500e1c68f41637a130ec9a70ec4c8662ba0aeb0b3b38058c0598fa89783a3
MD5 89c60b09d45d95035b34b95dbe893156
SHA1 02b721a5dca11bec65865286114206719841e71c
SHA512 aebed850a9e2e1ba9ef72ce3099ff5e9a50bd01d7f33343c1bff86fce805831ab8f4b59332e1196b1f6bcdde7c936e646db0044c0258dc4fd36bcb37da04b3c6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 2ded44c540143c58a2d73a5dc084ecee519b70ee254f04a3d6be4deaa332259b
MD5 97c6b947792dd70201e8d3e9ed3f975f
SHA1 c70e3a1dff0440531d39333c33494efe44fcbc86
SHA512 aca99bc980eb5c6e6b60ae0c258a8e1190accb782a69c4df0b113451949fedae9413d282633c8b874c590b41428b85fb117ce520a7964d2a8fdb038138f754ef
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 79b47ea682e783a0605ab9bd9cab1a157f38965b7991dbb1e33a95ae10926482
MD5 0ae522679e37675a81a2e874ba45db29
SHA1 6622ccf8763892e41a39ca80b631cff1dcc9ce73
SHA512 0beeb5de560152fa2b3210f270f1fb415f5ffe6a932b1f69d4caa84ab3824c8d4d92b1eccbc331277ea0f589e07a2ee16061bae44733300698daea35ade34945
SSDEEP 96:nkkxd1LSoj0wpvWMoiVmdeHmQIoJUWQyV+VDCziEwb:nkkLRSoj0GWMXNro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 3c36ba1b5056991d2ebb280949deff440f3e8c9bf7dd70b8b5d3d5ef95b1b9c7
MD5 a36d41a8d76137dcbe956113892fda94
SHA1 8366af00dc0a87c52b1d2f13e45c1afe9f7269b2
SHA512 9d28cb65a27ee4247b52ef6856b20b85cbc1994b2dea657efed1ed5368d38bd7ccbb46dedf84ea27d26d20a4afc9c23b28c1393d9c5fe60c972b6eb64d5fd4d5
SSDEEP 192:nkkoRSYj0GWMJ7XeeeFeXhDZNpf+AB+4CEe4Gml2NrV:nkZRSYtWYza
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8e8d924fb4a0832a88024c7c5eb80184226d0324930e59e518d50760210d2f3b
MD5 8374b03c588db7250f3e4ef363347ba9
SHA1 f1315ab93e857c1486172c14aea574d4f85ddd1f
SHA512 f6a1933e6bccf1ab8da1ce739762915d6e831364330a44484b0dafcdf19366c478276eb682b56fdb96650d00604fc294b8a606a9920361f9c4d486f7b59157fa
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7/9+e2RU2mIKbV3z2OMDCv:A9iIxuERzA83h09RZxY7/9g94VaOMWRd
MD5 SHA1 SHA512 SSDEEP

Submit Download