fe674f9c3101bf11fcc6608ce0b560b09f8e386eae70edc3f0d8e6208684eac0

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/09/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f45215d35bec0f2eaa4ac0f4b7d0d34e_JaffaCakes118.html
Size 46KB
Sample240924-xt26qstbmd
SHA256 fe674f9c3101bf11fcc6608ce0b560b09f8e386eae70edc3f0d8e6208684eac0
MD5 f45215d35bec0f2eaa4ac0f4b7d0d34e
SHA1 a8c646748f7d28c91bb1c83917be0cd21b1c58db
SHA512 bd0822c08d559cbb203c00b67f3c7a696d2a256662223b8ad1656477ba48ade966042a8d2ec61ffcee9d7c6cad31cab5e6e7302d621003eeb88a99335fdd7313
SSDEEP 768:qs7vUDeVXvr80EX4ipDJgG0Az4iI1bDdhTCbJdva1GDuAbtzvNN9tAL9gI29rMSY:qs7vUDeVXvA4ipDJCAz4XbXTCbJiGtXw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
4016	msedge.exe
4016	msedge.exe
2100	identity_helper.exe
2100	identity_helper.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 3448	4016	msedge.exe	84
PID 4016 wrote to memory of 3448	4016	msedge.exe	84
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 3184	4016	msedge.exe	85
PID 4016 wrote to memory of 1560	4016	msedge.exe	86
PID 4016 wrote to memory of 1560	4016	msedge.exe	86
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87
PID 4016 wrote to memory of 1192	4016	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f45215d35bec0f2eaa4ac0f4b7d0d34e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3dd746f8,0x7fff3dd74708,0x7fff3dd74718
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,14812647356822591620,4488705208504562555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
MD5 eeaa8087eba2f63f31e599f6a7b46ef4
SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
MD5 b9569e123772ae290f9bac07e0d31748
SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 41KB
SHA256 ee22a58fa0825364628a7618894bcacb1df5a6a775cafcfb6dea146e56a7a476
MD5 abda4d3a17526328b95aad4cfbf82980
SHA1 f0e1d7c57c6504d2712cec813bc6fd92446ec9e8
SHA512 91769a876df0aea973129c758d9a36b319a9285374c95ea1b16e9712f9aa65a1be5acf996c8f53d8cae5faf68e4e5829cd379f523055f8bcfaa0deae0d729170
SSDEEP 768:aOX/jdsw7ZDMwn22TDyehtsYYxGJV+7urGrBWObguJTHbQx+8ZtTe+/mrBZmOJ:9X/qP2/vtsYYC4cGrBWOjNHcx+8Ztax9
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 51f32575cc5266db0ccc1156224b6888bfd214e31cc4051282ea140eb4c036d7
MD5 38771a78f26de220d208cef371ce99d4
SHA1 57410248af6e30d63f72cacbcf2159238c9806be
SHA512 e42fcda6acaf2a412035c91ec0edb80ac0ff34fd138842ab9993a53016e1b2bae514b28354c6ae4fa9db3e03cdba456a186dfe66de0c681808fd6a9727ceacae
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 5ab0f885df79be09b88d9893bf4c48aa7fb15219bea873963a7be8d3261b9b62
MD5 bf8bfcf5e200e3e1655ab1114eb8c517
SHA1 220926396fce119b22509843e46f044c331cb001
SHA512 44572de8dfe443c09b3aa07ac4532cb44461a1c6b2c775f263794f74a2a6bf930b4dff2fdbaea127f18d95a5f9d6670223885e0e6de2cb9ab7a05624ba7f6904
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 8fbed0ae148616475b7affd384f5ccfebf43b8917b42d72b9efd77b97e178080
MD5 371609014c63f7282ca53ce0cef2884c
SHA1 8f20f3ef9623ecda25a8e303ead6242be2be4e7f
SHA512 78986f64cfa7c40d48539b48cb2fab5d8f68729d598618b4c231ef08da6dabb322efaae49be8566d5abfa7140276d992828a2c11097a112312d73215743d4253
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8093e28f17c5ede908a76481f0c24d40699857966fb3a5ab2f6166af399781da
MD5 e327767a34fe73540d0757fc950283b6
SHA1 001d20d42d65d5b47bd88e30667692167be7a602
SHA512 f7b3f5b2f04691c433e7e632b714a7516c245157a9a333766ba55331fcac71865b768993d8ae945905470d7740c12e9b1d4317fbc487ba68f93d4f6e6d9e0a6e
SSDEEP 96:nmlkzh2N1QO6wpvWMoiVmdeHk8h3lUWQyV+VD7ziEwb:nqkzEyO6GWMXvlrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 c6e7225c43cb097af2eb2d49f2c33f856096f7f49eeb1a9d897ebed46674a678
MD5 cfd75e8f4cd62b174989b8c81ee357bc
SHA1 261b45a5d4f076b68466d6ec8e82c2fc9e803e59
SHA512 a233335226ca6ceebc36d06188579d9d6f0584eb675d17b9ad52c1bf3d89b66d6706f3f9dd9652aabe77c69e5896fabbe69db26af96b511d87c15a5bed9a0865
SSDEEP 96:nmlkzMA2N1QO6wpvWMoiVmdeHPYmTg4Dra0t8G+a22k8h3lUWQyV+VD7AiEwb:nqkzUyO6GWMXPYmTgOra0tQa22vlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 94e617eb402ee67311d38a2c3bdfcb9de4165d3b14494fb883f29a2cd797b200
MD5 2aefe3f8d1d6106bdf625967b5473531
SHA1 dd3452921ba43d6ea9d848b3fac40500b84df7bb
SHA512 311c69eb1d3a575f49dd0ad2d4555c235b9346ddf536dc4b9ca82d3464085dffd79b5b9282038ea72929a37447f36ab274c2ed5d954ccd6d55b95cd0dd390f89
SSDEEP 96:nmlkzMo2N1QO6wpvWMoiVmdeHPYmTg4Dr0t8G+a22k8h3lUWQyV+VD7AiEwb:nqkzcyO6GWMXPYmTgOr0tQa22vlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5b3522c24d31ccbfd44d228c287c3dd776fef11979e14aa9cc9fbe4a1753ef6c
MD5 730e9a6718af5e4e4f7682a243821d67
SHA1 559c9afb7bbdb1fe4b62b999c1310058eb8e8f2d
SHA512 9c3b7d8b222a9b10996ec26708f6a3a57b845753b72736c7fbd7c5f94d145a1d0763cd726e8116ac0a043a5008bc1aa405a2e6e3e6714cb593d568675d072fc9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqe2RUCxnsCIcM/bo5ZxP:A9iIxuERzA83h09RZxYkpsLqZxP
MD5 SHA1 SHA512 SSDEEP

Submit Download