775dfdb420b3d0d3bf53f11db11d0e21f6084aced040b4ab1d361155450dfe3b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d26535380871d9e258f3179bf58a4322_JaffaCakes118.html
Size 52KB
Sample240907-va9qcstemn
SHA256 775dfdb420b3d0d3bf53f11db11d0e21f6084aced040b4ab1d361155450dfe3b
MD5 d26535380871d9e258f3179bf58a4322
SHA1 34d2d7e5d04f30cf0738d31cefca07212eca9d82
SHA512 3ec9de286cc8949e916b20cdb080d4f9629d301e6480dbeb3d180a74ec07b63e98e49666531f21458f3e53dc077aa2f51c0b59cddac86583e2c77228ff264865
SSDEEP 768:xWCNXPIpB3Vgcwe0za2SijPXncxFfkRNbmKQqhqlA2SPl:xWGIpB3Vgcwe0za2RjUJYNhql4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
1556	msedge.exe
1556	msedge.exe
2036	identity_helper.exe
2036	identity_helper.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4412	1556	msedge.exe	83
PID 1556 wrote to memory of 4412	1556	msedge.exe	83
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 2676	1556	msedge.exe	84
PID 1556 wrote to memory of 4004	1556	msedge.exe	85
PID 1556 wrote to memory of 4004	1556	msedge.exe	85
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86
PID 1556 wrote to memory of 4816	1556	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d26535380871d9e258f3179bf58a4322_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffb5b46f8,0x7ffffb5b4708,0x7ffffb5b4718
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10159165488673735325,87762550678057530,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
MD5 e4f80e7950cbd3bb11257d2000cb885e
SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
MD5 SHA1 SHA512

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 23KB
SHA256 1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4
MD5 33a83c16527e4531fbfca2631f653674
SHA1 87a63514c262ba4bffc52d2ceebb3ca14353507a
SHA512 f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3
SSDEEP 384:fmkqzlgw4CtpJByzHvyMPn0cdWgrlF1xUQNaASTJJlqC3Ix7RQLSKYfkXZzauNEp:ftqirs1yZP0yVn1+QNliJJlqnx7epD2
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 cf4d3abf685185e7e773f60cb6643b97d4015c3765afc343f9109c873606b40a
MD5 115eaea6f7ae082945a09e597001c549
SHA1 b6672d8de99e0e49136257055963918d3774ee04
SHA512 c34cf64425da2eaaf2121cc966bc7640b74cb535b0ae7b13de6046489414744f30384149be5e84a12716548a6aee77fd3e01d249f86d8048caf100d20788b0e6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 1e50e8d226f00a35ee9894a3c13db1b7590a4d53d7caf8460183fb6ce576ba4f
MD5 04f93f261197dfc9aca7cb9db6591e39
SHA1 e7ca12b7cde322a5c5c389d2c052a255a5b1d28a
SHA512 1b2eff374c7510a28c3a5e278062157d7b2d7254e5612266f979d43460c25bf3bdb6fd82a835f1ccd32b23882d2bca914e0f07c6255b872b5e8a3cd75c179e09
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 cfff059f7a09eeb6dcb59affeec5960811a41646974ac5258835b984708f3d09
MD5 e16fa7829440fa6591609fff33936ee8
SHA1 f378a985a68860f3931017fbb7b6bc19691abf0b
SHA512 bd2d75bfcaa7c8dede982fb9f2da67e2678b2d8227ee4c472948e9296bda53d7d64c83e0a5b32af88ee405f1fc80dcfb00243ee7c75840661e7f01cba77a3158
SSDEEP 96:nekRX817kTtwpvWMoiVmdeHTbZ6UWQyV+VDCziEwb:nekRsB6GWMX/Mro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5dcb955fa3d2d15a3fe106780f83ad8a04ab87d75857701697874bb3968dafa9
MD5 c39dea6d99684efdec4197ee4c8c6280
SHA1 d3198209f7832142d942be688a9c7d54672001d4
SHA512 57bf221978694ad726dc3bdda990fe10ac8acd3a147646fc881bdb577d1acf32d2f8f3c88428e67d506ef2c03bca5a590fc7addee87314b7da2f532da47f1418
SSDEEP 96:nekRO817MTtwpvWMoiVmdej/cNL2TbZ6UWQyV+VDCAiEwb:nekRbBCGWMz/cNL2/MrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a8e0f57c14286bb05c074a89874c078296da044e21fc4184ecf4d13b9db1c9f7
MD5 2c5772c98c40e8e6369a6281c9a622ea
SHA1 e4787278ab2ba29de038af9647da0d55d2545aab
SHA512 b330a2f178c0520fe1375f46b57300d5fc939d35f2ba74ac718841271836fbd5b70bdb97823b20f8e4db9e66bc0529a832fd721cd04d4ccae00639fe60ac5da0
SSDEEP 96:nekRS817MTtwpvWMoiVmdej/cNL2TbJ6UWQyV+VD7AiEwb:nekRHBCGWMz/cNL2/8rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b9bb514c1b319e61accea43d82a883d52f85cdb3d64ff4f5f2de2b23bf129794
MD5 25e0101c1ed0b451a6d15ca80022a516
SHA1 937599f7d90918a7b4b898dc1c724e66c74e0474
SHA512 423128585218bee0a407fa77201aab4d1595c0ffa10278c4441ea0461cc08415cabf12a734e688483e6315e0e8489ecd7e644b0289b468fbaec91fa4d496e081
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6HGe2RU6Jkjt4pBiZJT:A9iIxuERzA83h09RZxY6HIQt4ps
MD5 SHA1 SHA512 SSDEEP

Submit Download