bb3e8d0194d638399f8dded768ef93646b3bf18836e5d9e8a251d9b9c6464734

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c23f130feb3893b0e439b8ac780ce76c_JaffaCakes118.html
Size 91KB
Sample240826-enb39atfmf
SHA256 bb3e8d0194d638399f8dded768ef93646b3bf18836e5d9e8a251d9b9c6464734
MD5 c23f130feb3893b0e439b8ac780ce76c
SHA1 00c66782a70300eb5a02ae2c8ac2183a63ad81d8
SHA512 75ad88a4d0ef9b0c424ba3bf6d440b4a0d90354faa1c876ea00a33e0f74eeba462702db77e84216e1e0885cc2e1cf11e717b645cdc84c606e7ede9457913698c
SSDEEP 1536:kD2TO+q9oOpCORSwYnvvoygy2ODB2fnaCWdK//Fk7+p40Babffy1tlJ:kD2anpCORSwYZgy242yCWdK/dC+5Bcw9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
2832	msedge.exe
2832	msedge.exe
2600	identity_helper.exe
2600	identity_helper.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1704	2832	msedge.exe	84
PID 2832 wrote to memory of 1704	2832	msedge.exe	84
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 4372	2832	msedge.exe	85
PID 2832 wrote to memory of 3084	2832	msedge.exe	86
PID 2832 wrote to memory of 3084	2832	msedge.exe	86
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87
PID 2832 wrote to memory of 620	2832	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c23f130feb3893b0e439b8ac780ce76c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafde346f8,0x7ffafde34708,0x7ffafde34718
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 de62532e659ab364434e96c07ffe047e5cccfd36530784c7143783aa9f1f9a3f
MD5 554bc28dcea1b435b11ee6710c86dd40
SHA1 d4444293554a328dbf4c1ca64d224306ace7b383
SHA512 761a0a219752f049c91581eb239120f213793bcfdfe9499b742a0815d4dbb70a864f83bca61d4c93ad3c7c8b695ed98f6881877dc21293046329377d1c2f1949
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e5bfb323e30474cca32ffb1d333af670416ba866aecf124daac625cb179b93c1
MD5 d8778124e406dea6da8f08a735ae09ca
SHA1 5ee63d76c434be62c9a4f33bf65dd9e275740677
SHA512 8257df0a7a4affa55c2ab09fc3ecca41aa8ed3caff2fb9d99ffe44e2e83dd074326ec0969d7a5363fbecb754336410eb66253faabe0c6c86dc160ab65c99211b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 99b5230cfa1bd8bac203dc37b1bc01eca5fa993f14532bf1f45916f46149333c
MD5 83feee8b9e6792ff95342c5f005697dc
SHA1 4766e1e18b73e4cea93816ce80456a8cc9d839bd
SHA512 47bc982dbe206d585fcccb44593dd9cbe51cb43efaa3f57267caccfdb631fecef5affa72b2f40983232a0058ab6a944c4c19b3da14007f6cc5f3d2d00b8bcd2f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 8e8c525b6723a4e37acdbcde689b72931249c61c5f37694dd177fa1d5f5a62da
MD5 958f0e5eaea67e0b3c9a898d365f5759
SHA1 4c2694b51adfabf9f124db8673a8f88727933848
SHA512 44e01a6505597dccbe9415dece07993b418d0f607e81fcfbd1c8f800b2df05012d2af8c7bb996bda9babbd4ab57a4f4d82f5a9b4bf6f1d7eb2f9cc412eb71918
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ef4ad2840eb4d95c7b713d2c096516f7e386728bd1b7c540cac419ddb0bfbf45
MD5 b5eed4e5f8a2f3993cd402860247b72e
SHA1 276665b84ffc0ccf9099549e4cc2ef3f8690b2ee
SHA512 8f4de454abda6cd820da067494c0bd4cb6736550d68d540399dbd9843e29ab482a112909f89a4e01d6f5fabd6072269b45f8521022a11bd0ac9717dad9aff7e6
SSDEEP 96:nWkzFl14kdwpvWMoiVmdeH/ddWUWQyV+VDCziEwb:nWkz/WCGWMX1Iro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f3ffc6760bd4cfdc0fde2b4d7418133cf1eece3a3e76d77baab83ad16e7d8438
MD5 9d1daa5a62d50673701af02c1d6c4f08
SHA1 0d0abdf5aa9a2b3b1e030a377d75dd28087f66a7
SHA512 e13f89842d7bade9bfc28673dfebad80b410295486bde52f9df1055d89ab744b214260f86666db318804386676b8a2af91a3d6b2bd53b7563f907e4acd0392b4
SSDEEP 96:nWkzFl14ZdwpvWMoiVmdez+4h4vaHwgb2/ddWUWQyV+VDCAiEwb:nWkz/W7GWMD+4h4vaHwgb21IrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 2df97a06f27f9dba77d095e66df896996432a10b3a0cd48ef0c0bed77be9e32b
MD5 1ca07169ecf1bc3f44f03d5b10f3fce4
SHA1 86df6ec69fb15dec17b38b5325da19f7450180c9
SHA512 c3f28368eada2960ef97a8967b2821806e5f00dc66835dbf4aef9d11d77415cbdcc76d4b2917b94cb09c6ba20f65e78612ddf3c5a079b5a7669c15bd962ba5bf
SSDEEP 96:nWkzFl1cZdwpvWMoiVmdez+4h4vaHwgV8b2/ddWUWQyV+VD7AiEwb:nWkz/O7GWMD+4h4vaHwgV8b21Irg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5f7cf9ecdef6bab009a38c82258efc30b75f7a02d57f70e66ef3515b5d271725
MD5 ef295e3f9af64490e285f96a2c3d4467
SHA1 350b9d81a955e7902c88b43d056e6b5f357bf423
SHA512 42bbcea91dc1adb1ca8dfa5101cbb72bc338396ada33d6d62da65b4df3d7a88ae4a059f8498e90b0ccccdc7507c3cd1e9cde906f1c0b14e7f87b01acef29bc37
SSDEEP 96:nWkzFl14kdwpvWMoiVmdezN4aHwgb2/ddWUWQyV+VDCAiEwb:nWkz/WCGWMDN4aHwgb21IrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 537B
SHA256 572b07a1941dff87a66224b3f281f3a08e7989f8337985ad80280bf3ee9e4d49
MD5 b04d05be7cec05f2c5a5d0ece1008c79
SHA1 97343854b3cbb3382d197ec2b0bbd62fcc4f582c
SHA512 5385998305de53fa9ebefae509b5b9417c6288db23117d7211092164f4703731cf0dd498317d2f2b30354b5bb8e9323a6759f10031ab28e0ae76f2ed2631d9ef
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ea02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ea02.TMP
Size 203B
SHA256 b34ac3f407d48f594b32548e354b1f498b4af96354eedd10867decb4ca1bb3c2
MD5 c0d46de4cc9a965afa4b94a34a478916
SHA1 f146a8f97337156609af7222b862a6291d776188
SHA512 076d23c9e585e97b28e7822eb76d2f4a2cd113e9e6211add9ff8cadbdaa015fe96df4c90c672e54bd8db638105271ca4149bbcc72bbe942929f40f52069ac5b0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 037ef5aea2bb5adb1d35035cdb4807b4721cbee97cd2d838609710e6e8c58edc
MD5 6e61ab9514061f2223532abf3dc1c006
SHA1 4d2710b4bf56353b305c7e0ce775d233c8f66aa6
SHA512 22c0926fd6acdf0ce0e947d233781c23352cf34dcbeb8e8f8c9a789beabfaa975f47a6c975c4076366d08f72335dc0eebdaa51e52c8bfc878370b2b1d0588edb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRTWe2RUj23IRoRw5Ytj9ZV:A9iIxuERzA83h09RZxYJ4DYRrkLsSQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download