629d5e3ef35326684b83523f2e6aff46140d9d906b7c9aa45d818304428ddcc9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52b4d843f06edbc2826906bd5e532565_JaffaCakes118.html
Size 57KB
Sample241017-vc6fqaydkj
SHA256 629d5e3ef35326684b83523f2e6aff46140d9d906b7c9aa45d818304428ddcc9
MD5 52b4d843f06edbc2826906bd5e532565
SHA1 53c156f7931898e12bae7010954cabb4bacffbcc
SHA512 3585fc57f844d277ebb72609ecd8b2e4f6b24cf3c5bf17c0ba0f7c49485e541d0f10d6b9a842549870d01438c1c04ec84e709d6725f7005c8ede862ad0c6a56e
SSDEEP 1536:ijEQvK8OPHdFARNo2vgyHJv0owbd6zKD6CDK2RVrofNwpDK2RVy:ijnOPHdFwW2vgyHJutDK2RVrofNwpDKn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2844	msedge.exe
2844	msedge.exe
432	msedge.exe
432	msedge.exe
1208	identity_helper.exe
1208	identity_helper.exe
5272	msedge.exe
5272	msedge.exe
5272	msedge.exe
5272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3700	432	msedge.exe	84
PID 432 wrote to memory of 3700	432	msedge.exe	84
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 4340	432	msedge.exe	85
PID 432 wrote to memory of 2844	432	msedge.exe	86
PID 432 wrote to memory of 2844	432	msedge.exe	86
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87
PID 432 wrote to memory of 2024	432	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\52b4d843f06edbc2826906bd5e532565_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5a9546f8,0x7fff5a954708,0x7fff5a954718
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5367547126333868565,11579959460965009891,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5504 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 4a9706ace075ca6d32341642b29691f079120fc71981a07552912fa0aad2c68b
MD5 b7a564b4e6ebe8b14c75be3081f46b34
SHA1 b3ba4a4c645e951781aaa7a1fa730ea42f425b9d
SHA512 5507bf4c0b4604f3e760678fd385311121294ff2cd84bda2a5de847f5f3a37929ffd071400d59401f8d913dcfd1b0eea2fda5672e700e7af268b442f350e1727
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
MD5 8749e21d9d0a17dac32d5aa2027f7a75
SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
MD5 34d2c4f40f47672ecdf6f66fea242f4a
SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
MD5 SHA1 SHA512

Submit Download

4339c843-fca5-47c4-9277-ddc86c11294f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4339c843-fca5-47c4-9277-ddc86c11294f.tmp
Size 6KB
SHA256 6b4efaeb94e755876e4537169dcac71e845bf0d1711754dd3ca32861c463e6f0
MD5 2e55376d953e29c2963b36611f59cc9b
SHA1 400a9d934f44f9e58709033fcaaa640579713101
SHA512 d1a3a3cf08879903832a4bbc8a3e2b0a7756328dbfa65f324f1b267ca98cb8beadc870f7c125424bb7daf0841908ceaeef6776b99a1e6a3b69d6dc4d700344f3
SSDEEP 96:nXAkMO1P7wpvWMoiVmdeMmqjx4VA52hOMKVUWQyV+VD7AiEwb:nXAkDF7GWM8djx4VA52cDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 5401c8f288cdee488104b0186b933595a5b98d2a883e5bc94a130e55cdf13a39
MD5 4442267fbe8e66aec3b5ef120ea1061a
SHA1 e764b4f2548fdafaa777c88de0340d1c51a98f51
SHA512 3ae14b26fe3dc609d614a32f5257082914f75055b68130270c0c0649295d7c48054db4dd1c37e572cb0e4eb2f33635a0ead514e6c818e2f05d37e532eb0e892b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 381e6e7bd26af3af923152a2bf8ca7ffd66bb906f5fddff9595d6133aa3d5edb
MD5 3d4012aad048a40af2f9b6b062b4e2aa
SHA1 290b8eaf69814d38ac362ab878384bb47a4b3437
SHA512 f78f7699067084ba79f362bf78dbfbace8fc9a427bb4fc11f51f37a0b820b973a371d027b0e297725c9fbc8ef2797a09929ae17a28398ec9db895e7877b31c6b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4492a9aaf5f6c68978c9539d40db5b2af3c9d39c51a0fa9e8330fff66a54c663
MD5 9be3c9c5588ea85b7bf0793cb5804784
SHA1 e6e9b364f42b665cbffdca3dae7acb60b8df65c0
SHA512 0d3b1d068b42bdf6129c685c17853053ff454882453c96b42eccdc1d3089f3e0cb73728c93d6cca46a239c5bc7a4edab4ad96ed488e2f2f15ef498abaeead24d
SSDEEP 96:nXAkiO1PTwpvWMoiVmdeHhOMKVUWQyV+VDCziEwb:nXAkNFTGWMXcDro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3127a3a018bc355409c34fc6c59f998b716a3858d12871fdb5fba50bde52f9a6
MD5 3ea4ce4ee0872b5da3c32d9e7acafd32
SHA1 52edd88f2f3e6604f44e1c402b5b2bd4a435b9ff
SHA512 fa2ab58279698e16584c1d61e9626a47bb694b4a5fdb4ab618814e216467f64daac7d5d849e23af6ae50744208b93e94b9a941545a793a5dd3afdcee20bba49e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuph8yUde2RUkuIse11K3w7xW:A9iIxuERzA83h09RZxYhi5aenKIfu
MD5 SHA1 SHA512 SSDEEP

Submit Download