accbc3de6e1977f5f4b37dfbe839883bb3dc1bb4ad2b2c0c405adb618fb8a772

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 06:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ccc6a91981f767357f017449ac25de2_JaffaCakes118.html
Size 76KB
Sample241009-hppbravdpd
SHA256 accbc3de6e1977f5f4b37dfbe839883bb3dc1bb4ad2b2c0c405adb618fb8a772
MD5 2ccc6a91981f767357f017449ac25de2
SHA1 0dcc575273eeb7ecb70d2f0d5ba3d2fd20f49896
SHA512 6f979615f22c954183e5f3b9f5e4ea31e975e81cd97381028d73fc7e9dbf8d1335ee7529d99c30a9235e2c2f2736ff2f367539a6e2c3b52b8fd9b32e1878552c
SSDEEP 1536:DcXd8KBjmoNpTzQxHhM06AGFCjB4hY+BSIqyg5QvLgRkcdiIFWh:DZKBjmoNpTcxHhM06AGFCjB4hY+BSIqC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
4672	msedge.exe
4672	msedge.exe
3276	identity_helper.exe
3276	identity_helper.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 2912	4672	msedge.exe	83
PID 4672 wrote to memory of 2912	4672	msedge.exe	83
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2760	4672	msedge.exe	84
PID 4672 wrote to memory of 2892	4672	msedge.exe	85
PID 4672 wrote to memory of 2892	4672	msedge.exe	85
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86
PID 4672 wrote to memory of 3316	4672	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2ccc6a91981f767357f017449ac25de2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc068446f8,0x7ffc06844708,0x7ffc06844718
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10255469991115525424,17272016251162456392,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 4eba3e922a6b9ae083d2b140d9a7c315ac66fab12f2430380b53788c49852fc8
MD5 eb171bbc4a57b3ff002f4672d0fe5877
SHA1 f2389e4e8ae0694e5be168ece78f07f4e6b8f4d3
SHA512 c8adb799066b10584edc152a382ea2e78289020860a22766507c98ea21226d0198c314a92e97ad475c4a96688596ede4c97f122eaa15fbe077a003d5c9fcb49b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 5c869fa749af77aa286882a6c7f3295fe0fcb9b0bde89dfe1c2bc88a886baa3f
MD5 ef238ea3adcb55dfb4bab7ef23974d77
SHA1 c4cb4d074fdc3f6220e05d69585142cf3c5e6ab5
SHA512 970d919979b25bc210040d6fc7ca6e255faed1f3b3cfee85678efb134cd65cb81200133fa42343ab68b385ef09ad5d78bfa2416142ab54388749e4287c34db6f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 7f3d0e55fc6848c8b8aff3da9155d77ee888b70200b59e0f95df1d1a88c092ee
MD5 2b7b25c37bb29e3386f75b5c1536b103
SHA1 e0cdda1edefe1dda9b59a0d0c4de0e96e3221068
SHA512 4d80bfe19819dc67f7935c791deff249b30e6b8cf9f6ecf8b059938fd4bf60268ab851ca7753c3ecf07f2c78c4324a08378881152070fb8b569bef8e37d924a5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 ff16905251c321f90bfe483db8f260fb20e899757b1bc897965b6b41a0b2cec8
MD5 a3771a1976a5953c3f286c618717a228
SHA1 06b2bf32e7d8e8b405648a3536b353288555f9a4
SHA512 af08cd36932c0d055add6f3c6cd1233652e4c1d9a0c84e6110faa5e048899508120f2f2e6d23c980763232d1469388fcfed90bbce436ff64962719c3d53e94a5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f2b20878893b0d568f2099a021b3fab7ede3658996ca6a2b38760985e542e411
MD5 3ceceb306a686ff193f2aa0310b3f5be
SHA1 c740d4f64567a510b32c91d68a2d69456dfe851c
SHA512 e2dc915bfc7ca62bb2273268d37b4373431a1d2ddcee0c6cb6bc3dd743f4bb4ea5254be0c445a8be51f338c677210bde1c8882cd8bf3c8064f39a6f2c79c49fc
SSDEEP 96:nfkMs1Z1wpvWMoiVmdeaBNihCVbk5nFB+h8Gahq25eGjUWQyV+VD7AiEwb:nfkZ31GWMqBNihCVbk5FBUghq2rjrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3fbcdd2b2cc0ce982c582d0f13227c3b77b7663e6270b5bb700ea40f7f18e306
MD5 2a07075d40d4c02822c673698c827f0f
SHA1 2381316c16365828029a1e732c23612b1e79c782
SHA512 82246ea4bf1d47a443cdc8a20589b3bb812d43efff13b6f65fdfaccf92d568be82cc8b550acf815ea20dbfe80de2bc28af0c63116b5844197b84c1099c82ff64
SSDEEP 96:nfkVs1Z1wpvWMoiVmdeH5eGjUWQyV+VDCziEwb:nfku31GWMXrjro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1300a4e64703a9fb57ff9c7ef0e096df82a05873b6944a7d4dc7a22de8cecc2b
MD5 2e87e5f08557c64ed679771725b03a91
SHA1 3e12fb3edbc35e2a549bd823fce5e37de12d7d3a
SHA512 03fc1d99f5230b40fc239f11b01479fe361972487ddbf5e724cff9d04319cf3a77d3647e00e991485761228d08494bb83a63d02d40d67db84001d55e3825b575
SSDEEP 96:nfkws1Z1wpvWMoiVmdeaBNihCVbk5nFoGahq25eGjUWQyV+VDCAiEwb:nfkd31GWMqBNihCVbk5Fchq2rjrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 3e5476d0030b02e5e4fc4935a9c34ff5cfa49430f9c911eb81c45557db7d347d
MD5 aad4d19b0e9c9ec5c28e1a4d523b4c99
SHA1 f0e5a8e1dfd72a0d249f49a4a9f76917a600858d
SHA512 d2512960966706ecdfb89ba6b443c7ed0f65670555e1a393a407073fa71ddd7fd85ccd64553a478809e1e2913c120b3eec2d83650373cab0495d1a32d32c24b1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPe2RUnhLkyocu6+B1EhdZu:A9iIxuERzA83h09RZxY30J6cubEHZu
MD5 SHA1 SHA512 SSDEEP

Submit Download