7691ce4edad3b2cf915e77c32937aa1a005196dffea638811dc96eaa0f361c6d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff3608b4bc77765f4d19e2628f25e427_JaffaCakes118.html
Size 76KB
Sample240929-x25a3axbpl
SHA256 7691ce4edad3b2cf915e77c32937aa1a005196dffea638811dc96eaa0f361c6d
MD5 ff3608b4bc77765f4d19e2628f25e427
SHA1 807c73b96c37d3d0d171105170814c282e5a4bfd
SHA512 90de23ebd98d142ae7a80a4324b0c230adf8c7969fee1a75bb7a1aa3ec9b5f58f135538bf7ff4670b5ba514ce570af73623ea0cf80a60dec5f49104cb8b3d20e
SSDEEP 1536:meOyfMwH7T+dmdHquDlWmZn+Txx1psoTyElrly:mvykan+dmdHqupWmYTxx1psoGElrA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
1160	msedge.exe
1160	msedge.exe
4724	identity_helper.exe
4724	identity_helper.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1728	1160	msedge.exe	82
PID 1160 wrote to memory of 1728	1160	msedge.exe	82
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4692	1160	msedge.exe	83
PID 1160 wrote to memory of 4624	1160	msedge.exe	84
PID 1160 wrote to memory of 4624	1160	msedge.exe	84
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85
PID 1160 wrote to memory of 4500	1160	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ff3608b4bc77765f4d19e2628f25e427_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff636c46f8,0x7fff636c4708,0x7fff636c4718
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,16617129000942963777,5429316141263462654,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5536 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
MD5 eeaa8087eba2f63f31e599f6a7b46ef4
SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
MD5 b9569e123772ae290f9bac07e0d31748
SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 d02aa885ffcb8b71072168a0dd90df54151f04479248be7592a0bd43b6ee5757
MD5 76db1143beb6f2330fe7c1a1f8f5ccb6
SHA1 86ae15664822d758528e980a921ada023af7ffaa
SHA512 8fa76ea84199a019bab1248823e3e6811e325e854a73f736f6766c3cb14d8864044295e43da9310e10e378e589603225e565bf801e1c7a4a3a027ef0a65393b7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 db146050e1177b5c9658cc1dec21c65c4cae09eda0574564fc151378a01575b1
MD5 7ba78cd5d3e54963f7a83ac307e011f4
SHA1 98c9908b0028b344874b23335e7596b767532c48
SHA512 01c1b1af21b9e6357ee06395aef91847872fd3fb825cf9ab6f2d2c4ac5d6b91419e8443a2020ea77587f31e2f9131a6339e6410fd1046a33a0fb79546af1d44b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 0e1b190d5f93f54e056572c635d9e954130dcb696a84da57acb252931030f51f
MD5 de3bf66cfc437c9dd68307786a4a2518
SHA1 ca150856458be88fdb691b4504b294e78f5add32
SHA512 0bf2c6d5277a1135326572a5db2a3bf2df91880fc5b417ee7add4ccc74663cf24e4c7e090667974d90979021c1fe2b9bf7879b6451f6a3204ca15b38e09df7a0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6df35e1dfc08a7b65f79603f7b83d93caeee1a0b11c7c2c1f323d67b23bf625d
MD5 5afc3e9d6a3ec3befc2a5b11036a6350
SHA1 2edbf0131a4608676410373e5ff7726dcce1caa0
SHA512 dd3893d7937d2398380802e89bc09c10e66a22bf1a47d57054f0724ce8294b2247158432eb4577a35c09aadfd84409dd0865f50dc0592a148a24e9d52c0d45d2
SSDEEP 96:n4k/oN1bPwpvWMoiVmdeX10/BzEVL6x6vHErtADh2k8IUWQyV+VDCAiEwb:n4k/4lPGWMni/BY126vHErtADh2KrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d675cb5d37a85e4c0dea0daf1e71ba9a70314e5578649c04ae33ec8f7d4329ad
MD5 d837e12346652782fb2db0c9b98b49a7
SHA1 5910d965d3d33c1041c363d2f2f65f812be150a6
SHA512 6b23675be1ba58aacd8ce4d66dc162d68a39d95a0b83642699152fbfba88718030cd0acde0ec33176d3f316efda39c36a7a160317471ebca592cbaac0bf8a811
SSDEEP 96:n4k/2N1bWwpvWMoiVmdeHk8IUWQyV+VDCziEwb:n4k/6lWGWMXKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 2012e3a8ffd136661f3888e7ca3c88c89479c588f2a4f6486b430846f0de2f89
MD5 3dab9ea52fdb3bb722158a7a2211bc0e
SHA1 d5aa9c4d802d8377de658630718f51e80be366cc
SHA512 e616137d609e6e2f3d3f1c04baaa61ea4f934523cf2e07f42756fb6a72057c8c7e476f86ff2bbc0d42acdcb92200263fd79ac3f5845bf46522f8b5b593742a69
SSDEEP 96:n4k/AN1bPwpvWMoiVmdeX10/BzEVL6x6vuJHErtADh2kxIUWQyV+VD7AiEwb:n4k/glPGWMni/BY126vuJHErtADh2Vrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 807249d8dd4c34dcf1cd310fef4acc21b4fc33a1bd0a5fe8dd5de2a95b244209
MD5 cbfd83598c72eb57b1e788c8599960fc
SHA1 b69d85fbb158390c064375b3a87710c27684e82d
SHA512 84a27c2b4a402f8fba16dc0e3d70b6bed63d68f0fc8f56bb3dbf920c726b8e5d7375bed47334c37111a770d08a8d5d5ca2a110e5a156e7e500ad1e9b37bbece2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmfe2RUtxnceIcM/bo5Zx7:A9iIxuERzA83h09RZxYmnec3qZx7
MD5 SHA1 SHA512 SSDEEP

Submit Download