3047e5023e0d50929216d576824313de1a6951432703d7b51fab74b521f3f1ca

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c041485c64b2f5b58ea10e3d37f6b7b_JaffaCakes118.html
Size 74KB
Sample240528-g8vgfaae77
SHA256 3047e5023e0d50929216d576824313de1a6951432703d7b51fab74b521f3f1ca
MD5 7c041485c64b2f5b58ea10e3d37f6b7b
SHA1 d9c0b9d0dc23936486993c919387a5e86589469f
SHA512 07cf4d0255dcc704803d793a206788d1d7a5678d8cd278623ea5356c2750a97fcc1cf5ed08880fbc3326b6a45bdbfff159b1887a69c2cdb6b15b1091569118bd
SSDEEP 1536:G70U3FF/7MdFwWWhY4I+eEfuqxd2cewY6hTzA7ENHSEb304Auffh8DA/r1lDEk2T:GJjA7ENSEz049ffuDA12qL1cAsuFUfzT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
1204	msedge.exe
1204	msedge.exe
1200	identity_helper.exe
1200	identity_helper.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2740	1204	msedge.exe	81
PID 1204 wrote to memory of 2740	1204	msedge.exe	81
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 540	1204	msedge.exe	82
PID 1204 wrote to memory of 3232	1204	msedge.exe	83
PID 1204 wrote to memory of 3232	1204	msedge.exe	83
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84
PID 1204 wrote to memory of 1552	1204	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7c041485c64b2f5b58ea10e3d37f6b7b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff739b46f8,0x7fff739b4708,0x7fff739b4718
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,6027511098896365507,4241757943753090541,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

3351dc60-a57a-4bca-9cef-dd85986db1a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3351dc60-a57a-4bca-9cef-dd85986db1a0.tmp
Size 6KB
SHA256 8f114dba1442445d8a6979187d82a9999e0653da280774ced27763a70501495d
MD5 2c8f893fd83c535c3b80f9268256ab85
SHA1 3918f33119fec6d8b84136a3daf117eb86257479
SHA512 1d76f3f18f98393756285046b042c09f6cdc1a32326ce749be3094e51d75f91c6e59250f95a6d166abae1e2860aabdd0e7e50a2c68fa430b840166fc66cfeaa4
SSDEEP 96:n0kjzSC1I73wpvWMoiVmdem2plwtyacngfUWQyV+VDCAiEwb:n0kR2jGWM22pbXgfrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

7057d31e-0f45-4083-9004-e7baeb52b8df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7057d31e-0f45-4083-9004-e7baeb52b8df.tmp
Size 535B
SHA256 22ee649293c7f9ee1e524599d17bb1e752429ace230b68a09385dc10cd831842
MD5 02bacede1f43bf16eda36ad5242a31bb
SHA1 812cf926667f11991c0b31b67f2cdba1280ddd5c
SHA512 a65b35a2f3a1f6bff7778e177e4c3991b79f43bfe1884ef3bde523d7b5e37d6545b6b15e852bd47285a15aca2849e8c100858f2c82bfe13efffc55fcb64128bd
MD5 SHA1 SHA512

Submit Download

9f50178c-b2c4-4aef-b30b-f127b0c09fc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f50178c-b2c4-4aef-b30b-f127b0c09fc3.tmp
Size 6KB
SHA256 44d4b66e48fedd01145075266ebc66b398e64cc065d673274af9b5feb10e9bfb
MD5 8fdbf8ddd3004e1849c62ae609363e49
SHA1 b08d8d0fe7c94da18e37c7ddeee344ab7adcea45
SHA512 aa8eb7bc62b8b59c4335120fe6be057730286ff1f51d355942ba0cf5da0c4a540e3c2e86364ba7d4399094177f776c195a254ff615162591ab319a398449b9d3
SSDEEP 96:n0kjzSC1Ir3wpvWMoiVmdem2plwwyacngfUWQyV+VDCAiEwb:n0kR2TGWM22piXgfrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 bda0bbf8b1a15521c02cabe61801b64f0a0eeb2b797bd4b7d651925f82b082bd
MD5 26777f5a21ba09f2a4f75d66960aae98
SHA1 bd9395f14d24ca66cefa4b9891121a083734af8c
SHA512 a7417fcdc0f8b6fdf8e5dffb180dfbb9c156c5aa3af5119818db415d2332f1aa5c14e14e42db6cc7e83922b3ad7dba9a2d73d6667bdaa97bb4cfe8da789dde15
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 386B
SHA256 092d1ca8099e210648e5aecab958603993a344603b30d372405265fa025a0115
MD5 ed924fea2402fca9f1a2021a6fe28feb
SHA1 d036a6da60979dfb3c85baac406417095192dce8
SHA512 cdfee16b2ed3a503e4388a5095f7a3c337ec5b68f4fbda56a28d2886c21255cd5ef6cc02575fbaa918a0f0bb81ed3c2e36c241b7547c15fade410226ca9b28a4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 503fd031c72318bf87342f06dc2ac2e9b571df11cf42618a393d3863dd189750
MD5 29159fc3861b187b895ad13ac226b79a
SHA1 60d3cc7e688bdd151820a86f3cdea000e001c127
SHA512 5a746ffcee0471d9da3393b59d6c62f5865ba5fe08c948da3d9a58feb0992b9ea138c3937575ebf8e037be72cefb5e8e2233eb5a797d2a4cbf801b11cf688cc3
SSDEEP 96:n0kjzLC1Ir3wpvWMoiVmdem2plwwyacngfUWQyV+VD7AiEwb:n0k22TGWM22piXgfrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3eee4d803eac3f995d798fb11e6956f3d8b730c871e9de9fdd5ebf61b9d43aea
MD5 cbbaf4d3e517620433de7776c7b2d9b7
SHA1 70e08273d6ac0f56c3e9333cb415462856f3dfd2
SHA512 42fac8bc323175cc74aa6a79913288a497d9b60d008b9d53c4a18a75b743d2434e892d321e3600f597c984e1b0227abb9679f72c971f692b995959958a151f55
SSDEEP 96:n0kjzbC1I73wpvWMoiVmdeHplwtyacngfUWQyV+VDCziEwb:n0kG2jGWMXpbXgfro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 909223d4465fe33d2e396dd5f64a974e1b94d935f963e0f64395b37c5b9f52dd
MD5 f330e223fa72a380a96468aea2f3ca01
SHA1 cb7273c2603517e34aaa55aa7d405320f8bb97b6
SHA512 c83ab37a672c210e83bbdff1d8afc6ce73440228a7d86b97426475ca5f011ef395d71add0e1c2aed3d787f2b5c9539e6346e19bdbb862c8a883ccc6d8af74054
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5868b8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5868b8.TMP
Size 203B
SHA256 08c2a6321344e0b7146829bb892951bd9652375f1bf27e323f1f670c707cdfd3
MD5 8a6299ba5896484fb4535603ff8d4620
SHA1 026fad3689bd5478352e8d2fd3de8a7eecac97d7
SHA512 7cac5e3e7ac34fb54b5b328d10961d6d40f75deaa00cef43d2e9c71e8c0514c630e36bb61e1bc1f59202cf01ab5f65b65c2969b848629728908667c3e356240a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ff6bd56f5e7ba23e829491c01c8880764c26bbf674575cdbbcc22a45cc4e8ede
MD5 293aae2592e47a5920562cc37e61b18e
SHA1 df20d9d716229baa53f35ecf243dad8bda468033
SHA512 8c89f4438ead396efc070c72aac40c751bdd2484f241bf7ac1e553f826d0079641517e6715ae1dd62862da768537668949a25ef79584a02590cf502f00ac8c3c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupsXe2RUM2ZjA3z2OMDCRHqT:A9iIxuERzA83h09RZxYeAjAaOMWRHqlF
MD5 SHA1 SHA512 SSDEEP

Submit Download