079ae31e9c00d05d7f6c29d801181008744468bb0d9a1979f7711f67f38dc65b

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21f09535cda8c50ec6969033bb46759b_JaffaCakes118.html
Size 56KB
Sample240507-14nb4sdd29
SHA256 079ae31e9c00d05d7f6c29d801181008744468bb0d9a1979f7711f67f38dc65b
MD5 21f09535cda8c50ec6969033bb46759b
SHA1 ccd8bb2f259898bb78056ac743cadcab01e6a5ed
SHA512 af33b76a4a4447513bdaaadc6fabe3998674cd7e009c1af6c60cb2c570806bb285fb4b0931ea5ba5dc3cdaf02d41eda9ca6783908cedcb1c593f8a89ff34767c
SSDEEP 1536:nbI0kQvQ+zqeeTAsPG8Use7qiPcvqeaOGiQgPW5rTW5nrLHtQw:nbIYzYAsPG8UsliE2YA/irDtX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
1564	msedge.exe
1564	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4660	identity_helper.exe
4660	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1752	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1752	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4168	1564	msedge.exe	86
PID 1564 wrote to memory of 4168	1564	msedge.exe	86
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 4404	1564	msedge.exe	87
PID 1564 wrote to memory of 1424	1564	msedge.exe	88
PID 1564 wrote to memory of 1424	1564	msedge.exe	88
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89
PID 1564 wrote to memory of 3296	1564	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21f09535cda8c50ec6969033bb46759b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd387a46f8,0x7ffd387a4708,0x7ffd387a4718
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,17313382421181964377,8171998864064302300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x45c 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
MD5 62c02dda2bf22d702a9b3a1c547c5f6a
SHA1 8f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA512 a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
MD5 850f27f857369bf7fe83c613d2ec35cb
SHA1 7677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA512 7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 b9fb2c61e8b021545ee8431fc95117c203fc5e3af9f5773edbffa5700b781f0c
MD5 7823684d44bdf44c0fc945e3f8c21a32
SHA1 3913cbba22649dacedca7d219c84d17e3bf90519
SHA512 db0b4dc6c89dabe7e3694a4e5eae9759f39bc3e163ce6db8cfdd8fc4c45efc4b241f8e4edceb806830f3bcea3bedc3466275bf468ce914cc0bfbabdfd3104a73
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 7254b5a2534076ee5464c838cb7e6d4eadae99984a9c76f2143c90039fdcdbd3
MD5 9c8c6c456d902c84985a09f28c1fcb01
SHA1 dddbfa2cf2288bf990792557ee89e763171cdc66
SHA512 593c61af2d0c8f66bbf73993ca10872a7fe0ec4dcfea01ae1f5b514cc823fac88b82cfe837646aab821252977e51181ecc880ab89b4023139bdcb4e7b6f25a2e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 8f5021a9103fe9187db3bba2b3d4f3317ad62da0028d00401aea69b232def41d
MD5 5713fa792b3cfdc1e24d280982ec1e8e
SHA1 edf150ef9ffd8da703d4783949b59971d610da8c
SHA512 56931809732ca78a2591593a4ad54c05adc97a19b1d6377339a0025c85332501c52181bf76b7af89149da126db2c7ea0e86b2730bcc8461989e4178d16fc36e6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8dfa6d4941a626496e88ca577a500a80ac98255cd0fc73307d2e819300d1a01f
MD5 a2793433b3e95e137314f961619b72cb
SHA1 f70fba74d52cfa9abea5b3389d4a8a8631c3dfc3
SHA512 9deb43dffe37ae7ab446df26fad4fc1f678573736ba7b4125515a44754f7198d3666ccce3c45b025ed4f6a9af8a5e20ea11f220c991ef52811a23ac3b2732a94
SSDEEP 96:nbFkILy1chOfTwpvWMoiVmde5IbODg6F8Gt7yqqV+3+UWQyV+VDCAiEwb:nRkzKhOfTGWMpkOUuz7yqT3+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 47c571cfbeaa1c6e82fec89edd88f43839184947c0d8b24d7592ef18c1e9bea1
MD5 1960919011e50b137d50fa296f8eadde
SHA1 b35c8f7b5d3c2976444e9e0cec03ee53b06ea0c5
SHA512 5d065395ab29dfd9719f643c19142821adca08558a0df4aadac6d6f0f52d31292e078e4487b28db65ab6eef116455ae3d884683e2703bd90039309e23c1b94f0
SSDEEP 96:nbFkNLy1chOfTwpvWMoiVmdeHqV+3+UWQyV+VDCziEwb:nRk0KhOfTGWMXT3+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 09bfef711c144da76b3893a9823195f01f70f1e480594a2a755249e1d463e86c
MD5 50ff90b13ce64f5e1e1a5ab1a483f4c6
SHA1 98b6d37811c284363a9e923315a0c618785c93be
SHA512 02810ac907feb62334a3d4f0be5fc784a66bb89d2b81e44e0a57844db77207c876d152ac7b580ecdfda2be32830e704ded8b5440170508a2759444b6c61b6b89
SSDEEP 96:nbFkILy1chGfTwpvWMoiVmdeht0IbODg1Ew6F8Gt7yqqma+3+UWQyV+VDCAiEwb:nRkzKhGfTGWMRt0kOU1Ewuz7yqlH3+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f6d6bc4cb7c35cc5a7500e5b9182dd0523d02a86b0565bdda0faed7000a45833
MD5 b2784a07d9ba7e19fa6c913e6ad60813
SHA1 8065e882698a2c1f32c2036dd23a446c6d3b77a3
SHA512 f024bb9a2d4b6a740f4acb19feea9521a40e0828d9f8cda16f57ebfc4cda2f4e87d4bc4cb4d5dea1b232d73aed167ced0fce32cbe4dba485f80057a78ceee688
SSDEEP 192:nRk1KhGfTGWMRt0kOU1EwV2uz7yqlH3+rg:nR8KhdWV+H3P
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 873B
SHA256 62df77d743289169da75644b867840bbc64e0fbf65a743e0c8503663ac28ede5
MD5 1748b9231ad5ccad59888ed3524b5b02
SHA1 22a1997432ef2acddc1c4a9f41839b8ab3489a39
SHA512 bee9836c13a2aa07663642ee79d2a52f9bcab7d95e404b1f73344c56efc64dd1ecd562aa78999ef85bfe6b3d492cf0fbdff2bbc330fdfc7be3ef6d8818c518d1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58171d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58171d.TMP
Size 873B
SHA256 c99805e6538188aac6fd96cf86190c5896f391641c869bd020d6b6d34168caaa
MD5 42088fe8a9301af6934c55cd1f8fe0d5
SHA1 758863cdd24c8a897d9f99afffaea84d72ea6201
SHA512 488de1323eb885bc6bcaf165ac9e0363e91f69c28dbdc8618c9f56882c9690a69f0ecd4918678ab9bc078bf693a35ea5b392a93d569a2b29b0717be682c3b74c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a8ccfd5960934f6211e228bb40aa9dd54b9420be8e4178237bceb1d52c0f21ed
MD5 d07e9d8834ca184ccdac481c8415132d
SHA1 4c141cac7d1b0e08036486aac930afc611f14855
SHA512 c8079596e23f7260ab235affdc5f9df1840e7df98cf500f1f69d02112d6fabaab6b5508c4104efa2483159159b01ab1b4e7d468b6413dc8d6159a8fd65eb994a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupl8Re2RUoOEVC/+OblfBhDR:A9iIxuERzA83h09RZxY+2//XDafEBkU
MD5 SHA1 SHA512 SSDEEP

Submit Download