d565d7bcbe63496efdb93335395c1553c678f0c30cbd6d09c6255dd9dc542235

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0eee7441706bf96e2af67b207d821466_JaffaCakes118.html
Size 79KB
Sample241003-la4dxawarn
SHA256 d565d7bcbe63496efdb93335395c1553c678f0c30cbd6d09c6255dd9dc542235
MD5 0eee7441706bf96e2af67b207d821466
SHA1 2ae18e0c8d8de7b8b90331697504a7e1caaff07e
SHA512 40a34606520138b6d008bcb5c253795f981ae196ac637596c797703ba95271b725345d2a35e211132733f174e1350a33ba157b3ff94dc6db34ed39785b498e3d
SSDEEP 1536:JlLNCGEx04GqE63rqA0u+YnvjeIX69X73kwKTlqAbezJzu:jLNWKA3rqA0uDn5XCX73kwIbezJi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3088	msedge.exe
3088	msedge.exe
4324	identity_helper.exe
4324	identity_helper.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 684	3088	msedge.exe	84
PID 3088 wrote to memory of 684	3088	msedge.exe	84
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3516	3088	msedge.exe	85
PID 3088 wrote to memory of 3444	3088	msedge.exe	86
PID 3088 wrote to memory of 3444	3088	msedge.exe	86
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87
PID 3088 wrote to memory of 2972	3088	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0eee7441706bf96e2af67b207d821466_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa06a46f8,0x7ffaa06a4708,0x7ffaa06a4718
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1403989811058086496,11778841294116769146,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 252ff2a6d565309c3f139d0ffb56ce82240caf25a9bc44e9f90bd4238587782a
MD5 4bd01490dada3506f33dcf0124d3d512
SHA1 958444a11ffa175c2715ab2b157894394e6b2dd7
SHA512 e725991690455eb6e202ceec1997e30b0560ef3ce47bc545eb6a75476771712a4f4076637623a9c7f3a920fb7bb83085e0f3e3724247197f12af055ebe05befb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 5cdaf5430179fb956544b76d3d75b71caec7c16da3a5bc8b8af7638de2c56d55
MD5 1e0c606b6341bb8e0f2f32f12295a1d8
SHA1 8946aa0f4bb160f5503a348e27223126db2d46c7
SHA512 afa585b487f45e934a6e36b865df52efdea7baa66d4fe1e67d736495fc39a603e3eece14c23474de3f7bc750adafa775e54022c5b1db9aaca49e797c565bb750
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 4e8e3d6830757a42618d87dd3c56eea7f76b7d2bb5eee4c89f460bc3d9d2e552
MD5 c2373de1656a890fd13c3b52c113d404
SHA1 8552d7a6f585b0ef46f1f5d1a7a3fe27412ca8c0
SHA512 1785831d17034d41c7a496bf3c33810a0006093d3c92a4e06ec85914f1a17b3992770ba2d8cc60528cf9b75ccab27cd844b88c0db5dd8ca7ac6d44b1be411094
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 2d3c61304cdc1b9c42dbfe84bc649dcdb7c89121c439cf07d1e07813f3dcf516
MD5 bbecc2260cdff45f86f10e6e0a0c4556
SHA1 d9a8e0731d17d60f174c27167cdff596d04dce62
SHA512 9935ce050d8da8e94de9b29bfcd08200a31c5175ee566a36a420893b7c8121529b37a8e00645eba49ff6d0fe05776bab2279062905feca419aab65f03f287d7c
SSDEEP 192:nG0Fkz10+qXGWMmfFA2thY5vEqv52nsurg:nTFT+q2WZjg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 90b973d0f51a9cf2bed3efdb03eff534e6ff03fbe5ea73a96150b058505c7558
MD5 62ba9a2777c86f8c14b8341e9c578e61
SHA1 4746effeffe1423d916a4dceca50c236fa2899ef
SHA512 fb4bed35d295f39b5c3894d9b408a0dcb9cd4d62fdb4df240b92ada29a8f481944b17da98f3c7863f4dd81967c1492ce508ceb051a6285f6c66129d2d5a77598
SSDEEP 96:nG0FkzzW0+1sRwpvWMoiVmdeHm9/suUWQyV+VDCziEwb:nG0Fkzi0+qRGWMXEsuro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 aefaeb43926cb5914d73ce697fa836949293741fba3678084ef99d39d07ce73d
MD5 8ad9de411e04b6c6a8c698407da61402
SHA1 fd15c362a3ee732a39f482a9133bf22762016399
SHA512 1153f60d5930e8a3b7dc79dd1aafee05e5de106037889d534083f8fef4db802e9396af3d79b175dd93f4f627c9dd27163e04e22d16f74b616e72af22bf416388
SSDEEP 192:nG0FkzC0+qXGWMmfFA2thY5vEqv52EsurV:nTFa+q2WZjg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 36b05f48ac79d8b23e40b31605dc53c8d15db9cc205260ad5dec51e76d425f67
MD5 00807bfc0bc51604f8ff45f202fbb686
SHA1 242faed72dbfdaab2cbb148d2ab4340f8aa24d37
SHA512 c898b004695367010a48111073d5f7ba5f085218f5e9e437c8b8266a7c5c278ea439c6cc0384daac0766dc734134f3b6956d312ea64d83a1da017da88578f269
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupuKe2RUQl0dlYObLIcM/bo0:A9iIxuERzA83h09RZxYJUXYqZxe
MD5 SHA1 SHA512 SSDEEP

Submit Download