f8f4b92a23c55d66674c55f24f01a29bd9cca702821cb3482b39354c350a5fb6

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
802d265be814de566fa302ac93034844_JaffaCakes118.html
Size 133KB
Sample240529-kvz2jsaa76
SHA256 f8f4b92a23c55d66674c55f24f01a29bd9cca702821cb3482b39354c350a5fb6
MD5 802d265be814de566fa302ac93034844
SHA1 d0047ac2b8b3f60d66f7a59c9489d0fd7bd4579b
SHA512 9f6a47f8afec48819d78f0d5d8ed3557eadd1bd1b0dccaa6a152196d36f68ed6e6c4aada715b84afb7878fe8a616f4e0bfb56380069839cffabde1411194d2e1
SSDEEP 3072:D9er8Njz2S81Ep2yc2eodQhIVLX3iHPBXJ27/P7UHe9u2IntCma9X:Ur8RtDJLr
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
2116	msedge.exe
2116	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe
2116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1192	2116	msedge.exe	85
PID 2116 wrote to memory of 1192	2116	msedge.exe	85
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 4892	2116	msedge.exe	86
PID 2116 wrote to memory of 892	2116	msedge.exe	87
PID 2116 wrote to memory of 892	2116	msedge.exe	87
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88
PID 2116 wrote to memory of 1704	2116	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\802d265be814de566fa302ac93034844_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9aa2a46f8,0x7ff9aa2a4708,0x7ff9aa2a4718
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2137315351018718857,16808067084166217316,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x2f4
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 4df779a0944a47890654237dc65dc5cb4255ece760cdc595638a00b7d54e8fa5
MD5 d3c2fc4cdbddd03269bdce4c41400363
SHA1 b67d3c17b9b2cb71661cf0353120f0fea49f73b2
SHA512 4e10620816bfa9002857e82a0026ee757d1f37fc2d79cf0d52e031743939eaf778fb91effc6de6030cf21b91ef443cf59e615424645bc0b9dbd4f7fa5d13e4f4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 58a9127b599607b0ab7295d72f6cf1016ce5816acaf4ca6e7e5ab9133cecbd60
MD5 28bc5619f58eb1749bc63a4dd71041b9
SHA1 a7f32557032fc5d79daf8df4d96c983ea86068a1
SHA512 65d969dfc8c33503a3a893ee678fb102ae9e4c21887052feae023c667a4b8eb811d36b96f78949c580f94fbcd8af49edeb5a1e0505b58baf27355f829e3b9830
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 cf113b7914dde3f08a2789dce00c7c12f81b7023132b341589fb3586810bfaeb
MD5 7a39cbd30d9dc2f79cd6c14d3ab64191
SHA1 8c6894088c130ca504119ac4e52ca26573014255
SHA512 d34e47b1ae10bcfe012205ee0566c129394a6179afbc399af98eddc2557da1ae29598f7c4beecb15a75f5a0f51eb2850af8cba1e376029f19eac6499e619eca3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 72c69ac0aed829975199eb6f9ddaf8ff88a1e73db380f74e65cbebd953aa3893
MD5 5bfe3984c8c43f31232a56143aa03780
SHA1 fd7a3ea417bb76812af4ed7f505d1f9f1404058a
SHA512 9347e6ce6fa58c578449203540977547b57d90c8c2a26c92f8292f7c906c04d01c670e1d4cfe76a77e912535a1266f594ec6ed6634639f2413c2d356554e4374
SSDEEP 96:nJlkkZO1uv0wpvWMoiVmdeH/zM3AoNUWQyV+VDCziEwb:n7kNs8GWMX5mro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 45728d462eb0da3ac70c252ca15b5e0586ff3212a15a84ebcf2a38a981332d1d
MD5 7efe50265aac86ed7e9ac8eda26e91cc
SHA1 91e65b8960c2e529e6cbc37b260b2ad3ca6f299c
SHA512 b9e2f5db01977312f35c0465b184ce9c135920a14f5d08663483e87f130fd56e46fdff9fa5c219ebcc6a2206539e6b85ecd9d969f64efbc053022711be307868
SSDEEP 192:n7kQsyGWMqediabUbIY8J13dqLnhYG26mrg:n7NsTWbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 48a0e4a18659fecf954b168e21969c98934832911a4aede51445af640d958f68
MD5 8bbdcb6794dbfe99e3d4e5880d87e225
SHA1 aef913fe8480277d78fa2080aef9d85bd9aa9aa2
SHA512 e5374e38062f28ba7576414830c380a4870218715a9d1772454e7befa1f0238de1ce13c9fa657455f9e0ed171306dec4b06441e074fb82c912770ae01e00ef75
SSDEEP 96:nJlkvZO1uv0wpvWMoiVmdeyRediab92Va8J6Qd1G2/zM3AoNUWQyV+VDCAiEwb:n7kMs8GWMqediabU08J3d1G25mrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 916f34a78bf139e6c8fea3d0c38a45acaa2d778bdb60b863006ba826469df446
MD5 816580d2d8a307ab22571a6f0bd41bba
SHA1 e1adfa8c5c272213727cc80083961227794a479c
SHA512 efa87c4fe6470056b74300b843065a6f42e76c7d7582116d6ff31fd533a19002d2f9acc8520319b27cf9c561583419e6b9ff6615594bbbaf58357f09707f019f
SSDEEP 192:n7kMsyGWMqediabUbIY8J13dnhYG26mrV:n7lsTW6i
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 706B
SHA256 77a0400dabd3cc7c475880ea3bc360df836ec31edaeff53fa365c42827c02604
MD5 60337852071ec816171a8c93c5a2e73f
SHA1 e7c3b41933b988a9fc398e6cb55553f33ac4793d
SHA512 626a912be23e2996dbaeec391a24443451a328fa803f30e82bd5470312f7867063b9eee0ff176794c2791cbf60b6a5b54c514abc96e8fb6cdc93ebb8e91899a1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c999.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c999.TMP
Size 203B
SHA256 ad5c8635978bbb730b1f3e043e410157bbb47d5c3fd3fd64e832ff5fc84571d3
MD5 5c4360eeed344171bbb4206fa5a4eda9
SHA1 5e56df5f3fb92560eb1cfb67604e015bac2d7807
SHA512 dc85dec9fd1cf579b5318c246509c4e4e4291ca738ed7ac73f27b0c9c30caf5c314cc589e2f6b379f7ea6ce9c9297791a577956f15bbd103e28334fc2511062f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ab36a9af3ed120f8028913d5026e75376c3e6d40dabb726003bae4ce49dd88d7
MD5 5d326d585a991b79c1e6dd460db9629a
SHA1 32b3a5cb14df865b344aadd0697968e3c6f60f55
SHA512 dfa1064251fb1300a69ffc5c3f2c51aeb6c5ebea42b1ab4e2e3847977e3970fb775c78825626452ff60d9b9e1997acc10160a370bd5543fa512db0f9add98104
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6vde2RU6myc3z2OMDCRHql:A9iIxuERzA83h09RZxY055caOMWRHqlL
MD5 SHA1 SHA512 SSDEEP

Submit Download