671a37c4bbc81c0ccd5500cf61f248cb6721b277c2f22bfd1c9c34811ee9f1d7

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0ae08894e277ac6384d86a8395540f7_JaffaCakes118.html
Size 148KB
Sample240825-nx33rssfme
SHA256 671a37c4bbc81c0ccd5500cf61f248cb6721b277c2f22bfd1c9c34811ee9f1d7
MD5 c0ae08894e277ac6384d86a8395540f7
SHA1 15da173d1e544035306bf6a8df2b00a97f381d6c
SHA512 38981e769cf3488bf2360a0f03c6e1a07846993533dc38e2166599ec54538951dbf6c6ff775c6bca76f400d15562e4e14379f341f8621e27e542f6fe57843232
SSDEEP 3072:8FBSF3J2UP13G4k5QhLpOatVBFLi7HAm1DA/fNbYaaLStRVcxWUu/v66sbsGon4C:IIZ3G4k5QhL8atV4Am1DifNbYaaLStR/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
1940	msedge.exe
1940	msedge.exe
4972	identity_helper.exe
4972	identity_helper.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3112	1940	msedge.exe	87
PID 1940 wrote to memory of 3112	1940	msedge.exe	87
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 3432	1940	msedge.exe	88
PID 1940 wrote to memory of 4012	1940	msedge.exe	89
PID 1940 wrote to memory of 4012	1940	msedge.exe	89
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90
PID 1940 wrote to memory of 2896	1940	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0ae08894e277ac6384d86a8395540f7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc538f46f8,0x7ffc538f4708,0x7ffc538f4718
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8333896887283350926,16242711185225006580,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
MD5 eeaa8087eba2f63f31e599f6a7b46ef4
SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
MD5 b9569e123772ae290f9bac07e0d31748
SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 c0332dc67d4b60748a01a83d1e31bb945c179910bf11167619b84778c1720bca
MD5 a00a4ce73683e114963628287ae3e74f
SHA1 911a0415d1bc68299e126fbd9f6bd92256513054
SHA512 65615f2ff74d72cad31abc9fab04711b236aa1f125e4cf317d2c28e7d53b1f45114ce453b85dd9329fab3af8bd97b177d0b3decafcb47cc1977b2373d824ec89
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 cace2193243936c0ea6bb8f42b2afc3b2503e4bf4eb434e876f7e7139d67fe63
MD5 ec7f4f5dcb79aec76e5e346bb028f8c8
SHA1 cbb186bc96a32bccc418ccf9790ed6d68f18a557
SHA512 ad97fb2e2e85a5eed45591ec2722684fe4ed6f2fbe4dbfce198866e111b2208bf194a95668b8d51acc23e442c746150a7ca67a33bc1bf96530b7f2d3d8e34df1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 8d64f93ece3ec7275610d0e2a50c23d290ba6a14056dbce2416b8125f5151ef3
MD5 664525c56e3a855fc939af3bb112592b
SHA1 7ee3942de7293f4b2ca70f9a8d73e5173fc7179a
SHA512 92b4ba73b6b940063e1447f76748e8fc08b90aba3028fc6660d4292cf48ebf0446d02580bc65ddbc17683d13e7591408643d51e09804cdf1477eb18d9f17e46f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4655ab076184b0a15d8c4639c737cb4068589e0258b0cf872dbffd7e09ffc2ac
MD5 e228fce04d02f6b5f27684c082ce4d5a
SHA1 ee790f10b557061de60133aeff6960bf99ba1a84
SHA512 9ee88e1b05722cb1be78be986a0c2d516fb5f8918aeaa1b9563a9987c1b95c9c06cfcbb0840fbb0c927f89fa521d5858acd192bd1d7794cc0aa57ec8e5bd4bd0
SSDEEP 96:nck/Fy1w8wpvWMoiVmdeymj1e5l/r2k8hJUWQyV+VD7AiEwb:nck/Ea8GWMCmj1e5Jr2Zrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 5af6644535cf717d99c86aabaa66a98e42c8941f8e9099a86615afe8166a7c34
MD5 ca9a67ed923725c0d09a5bed1804d9bc
SHA1 34f5bf091996781ee2cf041cf1a53dc6781e67e0
SHA512 113c5e098429f07caa623a2ecf7d72b8801a4b9cefab2b4ceb016a642942ca1c2af5a3bb7fd42707dd8853e0f722ee9c51f7ff67586e78df6b7176ee2f127302
SSDEEP 96:nck/Fy1w8wpvWMoiVmdeymj1e5l/r2k8hJUWQyV+VD7AiEwb:nck/Ea8GWMCmj1e5Jr2Zrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

a8efb45e-54da-4430-a26a-7e6777647ddc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8efb45e-54da-4430-a26a-7e6777647ddc.tmp
Size 7KB
SHA256 3e95650df08356c50414de219cb294c4653691d80f8cb3ef1627e6ad36b9c377
MD5 bcece54841aae72e0d0eaf194c9aba9c
SHA1 99319293b35da41005da77cd60bad0887693cc1e
SHA512 79fcd180a2637242f26bd95ec92d87b0a4ebfc16b1385f30607476a648a003f9dd01c705f78bae8718b3c828d10c9f90e4fa0ff1ad0bbfd2a96138dc00da56ac
SSDEEP 96:nck/Fy1E8wpvWMoiVmdeymj1e5l/r2kkhJUWQyV+VD7AiEwb:nck/EK8GWMCmj1e5Jr21rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

e9accf1f-6ccb-4f66-a944-48abc27933a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e9accf1f-6ccb-4f66-a944-48abc27933a5.tmp
Size 6KB
SHA256 5aaddfb59bdb6a4179b630cd5780045b9726dc8e732ba12a3075f8d488e5c158
MD5 9865964ebaaeb2b38d0eff68aac4474c
SHA1 4db2a5382d0c94658c997d38ef4f0bc47a438c68
SHA512 4f4be53b1673e487c3d1124d21749e5b6d4430c97f8ae6b8e2607406859578ed8015f69e81ee7ca6b25fb85ed3792cd7c0e380f12c8a50aa488a271aee4cdbca
SSDEEP 96:nck/Fy1wWwpvWMoiVmdeHk8hJUWQyV+VD7ziEwb:nck/EaWGWMXZrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6b450a963abcada0269c78508bf9399cb996285137011bedd7dcee0d381a42f8
MD5 12b5cfb7ac4ee37686f4538699bd40a6
SHA1 ed5cecf586096dc5f3dedc796261bf7e165bc6a6
SHA512 3115a0386a1729bebb6ef83d57bd08d6399cab203c51176cee1d23d0f8f3a729aee94a9320158a47687278a55a984762d5ca9492e6932b88a2ed8d33301354e3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupbe2RUMxnLRw5Ytj9Zklqs5:A9iIxuERzA83h09RZxYLPMkLsz9H
MD5 SHA1 SHA512 SSDEEP

Submit Download