382ea06e4000404a253b98f97a07b7cf46ecf764de442205f2e7f0f827dff2eb

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91dc7d4486c44cd5febf9c2a1c7e4002_JaffaCakes118.html
Size 211KB
Sample240603-p5vxssfb3t
SHA256 382ea06e4000404a253b98f97a07b7cf46ecf764de442205f2e7f0f827dff2eb
MD5 91dc7d4486c44cd5febf9c2a1c7e4002
SHA1 6fd61f6b3f9c776faf0c6b51b92b2fe1689d1ec9
SHA512 1fa190683f996c96aad0189bebc760ab4281293dd0d873401e397af4c57fb67eeeae9b6526c7cbc34662c57207ff27e002c87dcb30627c9aeaaf2e413c3476bc
SSDEEP 3072:nPsAHCAKvkkv/KI57nKyma5KYmg1FjCxxtlEbZvdsesNBntgw:PsAH947VnsaQg1Fj3NW
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
143	sites.google.com
36	sites.google.com
44	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
1480	msedge.exe
1480	msedge.exe
4812	identity_helper.exe
4812	identity_helper.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 4436	1480	msedge.exe	82
PID 1480 wrote to memory of 4436	1480	msedge.exe	82
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 2024	1480	msedge.exe	83
PID 1480 wrote to memory of 4704	1480	msedge.exe	84
PID 1480 wrote to memory of 4704	1480	msedge.exe	84
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85
PID 1480 wrote to memory of 3140	1480	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91dc7d4486c44cd5febf9c2a1c7e4002_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8cf6a46f8,0x7ff8cf6a4708,0x7ff8cf6a4718
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7013398268344777992,7042670925929973473,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 21efe707e0c9d10f6a622c9070424bbe544d05782ff741d880a336da3adb92a2
MD5 837d7c6da08e390e2f860da02535a850
SHA1 cf00243f8e95a988c56b16a21453b0f91b5cd72a
SHA512 d403d18d15998971f6b82b831940b6e3c43093770301f143f278fa49b943ff0248bf361b0e13fbfb56550a175d100f42d51357237ed27acc2927d9e9f6b8dbab
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 5fc929bd845c2d6b1b9589f363ca1a56713aeadace3b8138cf3f021a37886b82
MD5 560949977b6a2542e5b4bc730eec7751
SHA1 b0bc882cea4c348adba704238c07baf81d46b86b
SHA512 483167c0ac30931d040e3ebf4fc324f6d3a6f50f70daabbffdb92292dec1b4545fc3d9c71224e1ad1b0602c6e3a03249b4cca5c3e07678a2a32434245bf56083
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 fa9a6a040af6544a6dcd3e7a6112d8f71f25e58a238abca734e32ca1a5ee2527
MD5 bdd18bda2358bc645f614dd3124fdaef
SHA1 9c11d8fcc57087435fa6d59f99793400bf5a108e
SHA512 20e9487515917861dbc33b90a06cce5de04e01b8a995e28881f35e28a2aec2b6da88681c3f06492ca6e0d57e3378d89371a4389f6e6e2b3bbcebc3c4d786c7fd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1eacfa59016841ede1271d56b71a8155852b52e7c7ca7d39857afc13bab90f46
MD5 c0adce9c650267224d9d3eeea6d8d478
SHA1 43546b2143cd0e9d879f10a50b0e859c847bdd47
SHA512 708a3f841e55e53661b04e8d215a959ea8ad883136c382c9dae46b391d9e15c18e96e197e5308109962334f4fc18b136bb8ca0b60ff54ac177075af962a719a7
SSDEEP 96:nck301mv0wpvWMoiVmdeH/zYCUWQyV+VDCziEwb:nckk48GWMXHro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 aca9cdd717c1b17bdbbfd6bcdc764021d6312f0c4139843ea43bb2fb5c598ed7
MD5 0d423d1f0a62c44b5b0e161de20b51c3
SHA1 fbcacf6d19324bd14e0591bd6b664f2ec39caa4f
SHA512 af9a35268a507712e648fdc34873634eb64a18473ef9c2c9eb05e8b78f1521f1d0019d7b87dbbd18eff17d237f0a82bffd0c38046c2640bc090a9ecc7f28ffa7
SSDEEP 96:nck001+v0wpvWMoiVmdeAGVwddheyKkCP2/SYCUWQyV+VD7AiEwb:nck1c8GWMQGiddhezkCP2crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9d2df2fd9136c2aea38556a53a699316575e4d10aacf3de2252c2e74c1fe2c7b
MD5 497a0c2056a4804cdc29f2ff28a83e93
SHA1 5b3e31a37d475394cbcc58cd8a0ada460b7c036d
SHA512 f5b37f9d9725e2af8c67a2afafd22d71c2ea0a486ae66f7ae117b885c3c3685785acc821854fd6d29d8dc1b72a5f75bc11db5f0a663e121d46fb01af0e739c3e
SSDEEP 96:nck801mv0wpvWMoiVmdeAGVwddheyKkCP2/zYCUWQyV+VDCAiEwb:nckt48GWMQGiddhezkCP2HrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 b359b9d6f08e6997492b2a2b69b85852854e288b14e95bb1b7ebc2aadb140dde
MD5 5506cbf1d61c17162b427beec8c40e71
SHA1 66a9cffc78e1f8de562ee0645223a43e91aa8d4d
SHA512 db19c87d92bdfc85890f4044580ad449cecde8e1b423be005b9d3c2be9e038571f00031b836a3c385e578307c90797dfc0fe39e4213bb85715cd3302b9a59248
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 a28f8e8b4089b00a68dc0ecd0762fe5775599f99911f7e65d95db05e332077c4
MD5 5bc3b413654ded94e1cc9d539df2e021
SHA1 7d1be5af38b3e2c84f96afb5e7db0db5940f2d47
SHA512 97f156be1428ff4d8e80e2cdf1040d95abd50215fcc9585cc02fc38c1b782c579ccabde445c5997158c9d6de0c9e1ae8ef6c3e7ce57d0e1979ac54bdea4670f2
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57924d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57924d.TMP
Size 370B
SHA256 7bcba4e7e7b485401c51f28efbfb5ec939810a9fc97c83416a080f5875cb169a
MD5 4fa3f68af8e8a138f8e252abb46265a9
SHA1 3130e142ae27c8fc1bbfba305b5b788a6af5941f
SHA512 19daed622ff5fce8d917a7745167fbf620cd25b9b3da5621c3fe98fbc8f3dd840281f61a38c9ff8175d05777a44537fb7732684b8da767ca268d6c1e85e396ae
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1eb56e5aafba6888e272c1d8bfdfedf59c5b1d7f7df656a6067c2a0a057e0e4e
MD5 08a91c23fe1bfdac76268f4aae59e9ff
SHA1 798502f03c393b40017820555043040e63e8d282
SHA512 a9b6d49e6deddb47c73fa0837ef8d2b85e2c90eca96f2590b7115a88721c596e302d25d8e999b2d6d9deac49717048144cd61adeef0d3de0497de82c36e8a18d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup4vZe2RUhPyPS3z2OMDCRHo:A9iIxuERzA83h09RZxYWNJPSaOMWRHqz
MD5 SHA1 SHA512 SSDEEP

Submit Download