d6855ccf46ebc6d584a9a866f904a302fe483e95fb8133d237810f246fa95b27

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8079c45c387492014f476dde05938ae5_JaffaCakes118.html
Size 92KB
Sample240529-mte14acf69
SHA256 d6855ccf46ebc6d584a9a866f904a302fe483e95fb8133d237810f246fa95b27
MD5 8079c45c387492014f476dde05938ae5
SHA1 d20672eed71f7f4f5d35f09ebb6e84c69c398faf
SHA512 628cd3745a55e8f9e824348f5abdc53fcfa63996e454415ec2a9c97c8b658a14d61c7031baaa716a36fe650020d3d2702513c7d8f8dd6d9c5d16ea318ef1c7dd
SSDEEP 768:uOsCivNuw3UssKeQHSmDIivH4+WgPcbJyBWsGzsv+p3YclPYa1GC:hiv33Uq9AccbJyBWsGzkYdGC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
1240	msedge.exe
1240	msedge.exe
1552	identity_helper.exe
1552	identity_helper.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4872	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4872	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 3700	1240	msedge.exe	81
PID 1240 wrote to memory of 3700	1240	msedge.exe	81
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3716	1240	msedge.exe	82
PID 1240 wrote to memory of 3416	1240	msedge.exe	83
PID 1240 wrote to memory of 3416	1240	msedge.exe	83
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84
PID 1240 wrote to memory of 4984	1240	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8079c45c387492014f476dde05938ae5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b8946f8,0x7ffc8b894708,0x7ffc8b894718
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1304 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11844852594692689236,13934245232354337776,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 628b604c9621e83ce1ff674807c3b84b3c18350dd7d2074006e4526d7a0e3226
MD5 180700fc20b48a8e061430cede5c5b63
SHA1 f310d219867287de23529f634bb5b25ab9b6bad5
SHA512 d31cb3401d3c527ab50175ee0e972cd84925d9c3602e899e5491f9adcfb9ed7800005aa9e6060c932acc465d166852a84feed180066a4459cee299a4867e630b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 fde9fd8d12e178221a5c1ce2a52cf7f43ddba84e202907db057cbb8728589ece
MD5 5e8996d79781eefbe06d3bf657b6c97c
SHA1 76f1c2eefc0d8305d6267e176f2ba4d93a8ee4d4
SHA512 fdab31ce57ad6d1c0a0bc537c8a716afaac20896fa91a8bf5ed192fa50a54b6a2d1bf98f29c80efd8bda3fd8714b798c3d088ecb5a2b8d53bce4f9dea8cdc359
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 ecbf67ace61a4e64d741eab05936d3f5e2abe35cd5319eb7be828a157ba925d3
MD5 a29f79f83320a6c5e930e5f28c5f1a2f
SHA1 f01ed9a4fc8a25303f02a53c054638f4f04e9ddf
SHA512 55dae694a306c653129cf1566d095e8b68ad2a43cccddc04fb58c800b4d5d59785ebbcc5deb3767c77f1a6312f35d0ba4dd39904276554b17baca795bd44601e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 603a82cffd8bc264e8b36627454bd1d5dbb9397dbbd830e295833d29bfdf0d44
MD5 97512276dbfc53440a70a944953f404b
SHA1 3f3771ff163cad734e1f3fd4b9330f27a08cba95
SHA512 8e6f6c81fafb3b86475479059596419879a1b9be0095e556a16b220c1317ee5ef4c1fba81d22808dbe84fe4a0d8eeb2edda6eb0ba39ad5c59c9c1a7d43f618a9
SSDEEP 96:nAk5NQ1qUega9IQwpvWMoiVmdeHpCrsbrl+UWQyV+VDCziEwb:nAkIcUNaCQGWMXpLbrl+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 623289b274373e6ca5a6cf8bfd81eebe3dbd076711a2c50b1502059abc63412c
MD5 ee2af0aa06a9ad46aedda72ed97eaf47
SHA1 a262d55771f33a1ceccd4ffb44fdcf9f0fdedfb5
SHA512 ac4d120252084db38155ab50e7c1b9c23fbe427347b0114d32fabe2ccd7a4bd57e3b200440246a0bd0758b87b68297affa13003ba486e1cc19661617387c2565
SSDEEP 96:nAkENQ1qUega9IQwpvWMoiVmdeX8GaqpCrsbrl+UWQyV+VDCAiEwb:nAkvcUNaCQGWMn4qpLbrl+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 868B
SHA256 16c4646d0e6eb754fc120b8da87c8a0d30fdb27808ec386c709427c5e7e6e9b9
MD5 2f65cfc372070305ece47ea3885e815c
SHA1 50fdcc0694a5e52f1333127553d2af4bcc8aea0b
SHA512 4bef742de15cf7dd80191dc9189c58edc498dce9eaaafd4563ecbd118d1ae2cc71be39ddb0921f88c8cddc89cbfe194694dd478492e867fe24d03b4a74938cb1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe585abd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585abd.TMP
Size 698B
SHA256 d0a524d4bf8d0a588de7d18181ccf02417218354b098e66b4e74c5c7b5bf2e67
MD5 01958322ba08a88f7bcf500934abf036
SHA1 68158b9d29ddab293df509239ff05f432a5c8c65
SHA512 e03d1374e199d4396d89d51892f6344683ee592a15ccd9cc46a8519b92825841ce9cfa0304331ad270b083b307cf0ba093a29f449ad5ef6105646d5d1153c83d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 56fc93d7b0abed70f02a10bc4a47ea780786cd9217fa48029bb2a763b249891f
MD5 4d2f94c20d10fdd0dd52dd6620ac1bc2
SHA1 b8c2dcd9da6777bd78305d5bcaf10771acd83a4c
SHA512 d774933920cc889f10259b372e225b9be3196d317b073fb9aa0a8bc92553638a8e162f08d8167ee55fcfde67138e7625e9815cd59820ac0ea7c8d33e804bf800
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3kDe2RUXh/jf7ZoL3z2OM7:A9iIxuERzA83h09RZxY3kTShLzZoLaO0
MD5 SHA1 SHA512 SSDEEP

Submit Download