6df5c2f54bf8897a54a91b89f9883a81d12c186cde8f86c5bfa55596abf0a96f

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f4d440b871951dc976a7f6c6da2292d8_JaffaCakes118.html
Size 83KB
Sample240925-bbmsfavgkl
SHA256 6df5c2f54bf8897a54a91b89f9883a81d12c186cde8f86c5bfa55596abf0a96f
MD5 f4d440b871951dc976a7f6c6da2292d8
SHA1 afa406ea02f6890f6518de1ddeaf5dcd082face2
SHA512 cc20f6fcff91b7410c804e7a9a6969509c2db090c1cf3fea0ab1ebae782a3a6a11edabe8ddc155f932843f235f3f8b15b5b3699285a4bb8979ba452ee437f5a6
SSDEEP 1536:FLNCGEx04IwE63rqKe5e0eZo4Yo6FocwYKoVwPfYulqhbcyiJl:FLNW823rqfeQogoXYDwPf8bcVJl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
3628	msedge.exe
3628	msedge.exe
3556	identity_helper.exe
3556	identity_helper.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 2016	3628	msedge.exe	82
PID 3628 wrote to memory of 2016	3628	msedge.exe	82
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 1192	3628	msedge.exe	83
PID 3628 wrote to memory of 2724	3628	msedge.exe	84
PID 3628 wrote to memory of 2724	3628	msedge.exe	84
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85
PID 3628 wrote to memory of 1628	3628	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f4d440b871951dc976a7f6c6da2292d8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87df646f8,0x7ff87df64708,0x7ff87df64718
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15981612114882187740,2715320441700751365,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 ad79af50a65cafa2b78854e5e72ee3def1ee491b6e6434dfea2e24610bf9bbcb
MD5 d60918d16a725936e0ee703195b6fbf2
SHA1 80c152c729446de08c6885a5e4a267ca0d2acd6f
SHA512 afb0a94048f37859ed8efb318fc88bfcb88813f4929e9f4499e1c1febdc5d145e1606a4ffb0bc86320aae792f590df57cdb8f7048ef7f58df6d30850d0fbee5b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 be7d0b98ccdad57602fb7eda1313128e6dd71d046367886571f29027ff6f8952
MD5 815fc2801548c19471a3c01c6843aae3
SHA1 71111d18eeb8f228ef672a38c1d590ea4ab89181
SHA512 e56184789fe5d396c1df612fac4eb73e006cceb7787fe6155460ae40e8b61ce9dc91d46331efb53465552cb29c5ca4b8c57284085846642161ab7ef55e0048c4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 7fb41eb7270ac2bf9ae4c709b2b590027bf8d1cb2e05006196fb2faf996bba78
MD5 5caf0236c5a1f1a1902f83a6ac863e8f
SHA1 3d31e5f244e5a35b21689323ba63584444a43cb9
SHA512 212d6f0cf7a8b7b3b9a178ecf16ce56d9e81f4c68d2a5a196e0677877cc33b204a3abd9caa6565bd01097d5031353d80bd1587f275eb94de98f32d459c97dfa6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 82ac72f068210a2033d342721c8cc9f52fbffd5f20780bea54bd841fb278bbfa
MD5 c9e789749f6fd5015a48ab523ba4d185
SHA1 16bae14bc9fa0ec8e123299cf7ac67aba5934a7f
SHA512 cb9a40ef8b9cb7df295038824ef0bb00cdcd3d12547c4f6f149cc343caad52e7efda3b5b45203bda29af50526f350a46e411c6b7199eadf4874d763c0e4141e3
SSDEEP 96:nx/k8tmhBx1dzTNwpvWMoiVmdeH44YAAWXUWQyV+VDCziEwb:nx/kHjxnVGWMX4hWXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 bda5146116495bc66cec8bb053d783f45e6607995081ff0904e31e6c771f7ee8
MD5 6ae131db16a941c9664f592fb10701e2
SHA1 e79f49441a4e4d1edb60121c0826562ae0be9742
SHA512 84377d65f06db31b81b4a72994cbbbd7a46041feec39bab36cd8caded47d0982a50da7cf0fafd6dc65e38981354c2cd282a9a9b1a094487440afff288009c53c
SSDEEP 192:nx/kHcxnTGWM5sf1CglQUvq7Tb0CzElLw024gWXrg:nx/DxnCWcy1Vy24PZYlc4gWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 72675281cd16188e63fae2eb755f3d7a10b3639cc5abe8dffb970ac361008e1a
MD5 3898f3f5e081534892101d4b4e8443c7
SHA1 8b12acab190dce6a9e1fb2983b822ec2d1c5991e
SHA512 ae03935b1745d0a2489e568300d81e994bfcbea2e126c4fde6db2820e006c60614fd9ebf2be0464221dc8706c5a83965b11749f0d46a1c7761ec3686ba7e48cd
SSDEEP 192:nx/kH7xnTGWM5sf1CglQUvq7Tb0CzElLw024hWXrV:nx/QxnCWcy1Vy24PZYlc4hWZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f8eaed83434228d4f04d0c92bc9e36ac59b6c0f59379fcda34d6d07989ca6b05
MD5 4f3b131c5f7fd25fcac7511b4af573fd
SHA1 0d12a38b713c3110e4d0ae9e956382bfe1cdaa02
SHA512 18e9aba2dbe8675c7101d17be6123dab0197d18b984fa3fec03878416388475a6bfda75b58165c5c2eddfae8b522438ccbc7198679a48e35e0bd318c3943b07a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3re2RUD1NOkMiIcM/bo5Z4:A9iIxuERzA83h09RZxY37q1ZMrqZxsIU
MD5 SHA1 SHA512 SSDEEP

Submit Download