f8400261837604ecf7823b81eefabf6ff58c1d5a1d344aaccc0505db8f40fe1c

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2024, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b0ac9cc4e0ecce0975059f7a137071e_JaffaCakes118.html
Size 53KB
Sample241016-c2b93aybkg
SHA256 f8400261837604ecf7823b81eefabf6ff58c1d5a1d344aaccc0505db8f40fe1c
MD5 4b0ac9cc4e0ecce0975059f7a137071e
SHA1 80839f5793514f8d3f30982bed2944b80fa4f66c
SHA512 4942a7d62040559beba5e0619a0633370003503ef24491e4263ee83ad84f1d1af0fef5f5c791ec98fd51267a7c05a6c08fd625d8654f13cd3027b538d4bd4af3
SSDEEP 1536:h33HdU8v9TVBhc+Y7UHTQyI5Qxl9UeFhhzpcgv9oDfPoFd:hnHdU8v9TjhcH7S7I5Q1UeFhhzpcgv9p
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
4808	msedge.exe
4808	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 908	4808	msedge.exe	84
PID 4808 wrote to memory of 908	4808	msedge.exe	84
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1232	4808	msedge.exe	86
PID 4808 wrote to memory of 1232	4808	msedge.exe	86
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b0ac9cc4e0ecce0975059f7a137071e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff240946f8,0x7fff24094708,0x7fff24094718
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 a94a8964c4c96063b23a7d6bf38863ccb0004710b4939ca699ac0e035fcc7cc0
MD5 9408721e16dc70fb726ba059acded021
SHA1 2ea408247c4d9c56ece31034b75a66a7fcacc6f0
SHA512 08d39fd7c34c37260f2f09c036c35ffb7f782526087c53023fcf18057030310c0dea30fec361c50014a152da587c98aa5e05c03dfabbb9ae6327cad77af60852
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 5c1e11054989d3c3d5fbaca4fd589f8ac776cd7fa400458f09cc6802d888b529
MD5 6e1596e0e4a6bf2e07f1ab0c3672e10a
SHA1 a5eb47aae647318da58a583eb66353e36d7dd6e2
SHA512 03485724bfcfb1d2aad167d2af8f872d716db4093643df776ec903997a112b6b741db0f5faa179ad596c3b56dc520d970e027708abb965dde135ed55e682a89f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 09736208da9dfe67c1e3fa031274dfa55af0ab71160efcf38d5c2d517eb3d388
MD5 194e7713161235bbca703032e1cca65c
SHA1 1524f9b678da8e025e328db1ed47b63421ef2987
SHA512 00fd0635ced11428a3fbaf431f6378dfee86e16527242e3296a11c41988accabe72dfc3f6634e7b136933aa969d5cfe3e0a910cb218d35de4be4a1742d804eed
SSDEEP 96:nUdkKxm/B9mqkk1hNwpvWMoiVmde6g2hbr9Qy25eiUWQyV+VD7AiEwb:nUdk3ODkXNGWMqg2hbr9Qy2Drg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 fbde733ed16df6714c7faa54077c86a69b29380b3d8db4b0f93b697cdd45476a
MD5 3e3ed58419899ed5147fc3deaac3b9f8
SHA1 1296057c706020afa619d5590c2f359de46c1728
SHA512 283d140d577d08cf3176460941176ac9c9a358ea84742f953706d268556ded15976957f47d851b5cffb5b2a480435f5dd250529fd2573beb8827700cc1f73974
SSDEEP 96:nUdkKxm/B6mqkk1hNwpvWMoiVmde6g2hbr9Qy25eiUWQyV+VDCAiEwb:nUdk3/DkXNGWMqg2hbr9Qy2DrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

d38fd265-3f28-4c3d-b46e-6ea3819dc989.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d38fd265-3f28-4c3d-b46e-6ea3819dc989.tmp
Size 6KB
SHA256 e3fd0c71057152ba9c3303a3d2d4850dedb1b817c082189b19691d3b1e60ec91
MD5 881f91a0901851e574c3b9f35f8fb4bd
SHA1 50b571df34a54280c50879af935963f028b99892
SHA512 9756c475a3bb75954bc4551a5561180f267872d628d3ded956fec84f6bc42a64bf3e0d33d962fd9632ba5a2f905bcbc8efc182279c078d98800402e045ade8bc
SSDEEP 96:nUdkKxm/BQYmqkk1h9wpvWMoiVmdeH5eiUWQyV+VDCziEwb:nUdk3KDkX9GWMXDro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 1cd2a5590152e70469960feeacef56be49f53846a63beae818df3fceec1a56ca
MD5 a3cee77953c40994574a7a28e01734ad
SHA1 44ccb5c98699477cd231659bb4424169d4c353ae
SHA512 9134174e7a35c361b4fb3df383e38e1e041a8a3f2f18b4c3f37b120d45b6d4fb8d5959d5db722d68b149a3957b907bae1f08d51f60ee67c080715b7bc8c44bb0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0Ne2RU/xLkyopb6+B1EGUG:A9iIxuERzA83h09RZxYuo56pxbETvu
MD5 SHA1 SHA512 SSDEEP

Submit Download