a582dbc92a8732dafa7528eb51051b9907da9e5ada47f574b7846c5afc9e0bce

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc9a4636ed2a27ed57292059ee7a2ade_JaffaCakes118.html
Size 215KB
Sample240928-szcqtashlr
SHA256 a582dbc92a8732dafa7528eb51051b9907da9e5ada47f574b7846c5afc9e0bce
MD5 fc9a4636ed2a27ed57292059ee7a2ade
SHA1 489271c9a2fbff056b4ad6f76453e38e071a0dce
SHA512 933729280551c0b4101dbe2ccf830ed392803fab1e69dcdbf7989af1f11b45ddb67b476e1f4f409a5e0d7873b48ba7b73859db8b35f7d6e17c10b4141d48ce97
SSDEEP 3072:4h2TSoM2jkVWxJljPoaHmOVoPqBTbj6MIXi4eCVEx5ETYufZ20rSJd:dTvKG/BJieCV+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
3464	msedge.exe
3464	msedge.exe
5100	identity_helper.exe
5100	identity_helper.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1008	3464	msedge.exe	82
PID 3464 wrote to memory of 1008	3464	msedge.exe	82
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 3268	3464	msedge.exe	83
PID 3464 wrote to memory of 4048	3464	msedge.exe	84
PID 3464 wrote to memory of 4048	3464	msedge.exe	84
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85
PID 3464 wrote to memory of 876	3464	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc9a4636ed2a27ed57292059ee7a2ade_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfff146f8,0x7ffcfff14708,0x7ffcfff14718
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1476 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,4929353187248579636,7234822087214185407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 23KB
SHA256 60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf
MD5 2f24e0f5d2c2997a89fb4a8d943c141f
SHA1 99515bde1a5bf72105116ac902ccf3db1dd3df29
SHA512 0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d
SSDEEP 384:VSCKOXcXVC6fizIN66yBc1Ei49Zvi2fSZ886pETkDCm510VS7X+r27Z:aOX/jd6yJiOZa2aZZNAFmS7X+rEZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Size 23KB
SHA256 7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc
MD5 c897f8479da25ec570027594f1b4db24
SHA1 81a3ff06cf35a87e697fc4733966dffc270ad06b
SHA512 b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10
SSDEEP 384:tU+gw6ZANCOehcIFLQp1N7sYfDUPbBGbouF/Ufk+/mc6522rk1l+vTZp4UMIoXAE:tUW6qNBeaIRQjfDDbouF/Uf+c6kh1l+6
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 d637b2d2af7f3c9de6279e8a3a68babe09ada1d4e3f4bf167b8f21e4c10bc56d
MD5 4618068d1e301927f8dd17f8afa9700b
SHA1 a170806dc8c6a1f317558ed79f86dee5bad2a907
SHA512 83c8a9cb3ce3457232be922d14a2d5f9688caca0b9bbb89593e93c8f031f22062b53b099f2b65021c57683e17658d6245b8bfdb3788caeeab4708508168ecef4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 56953271ada39af9cc4822d635156dfa0dd5ab4fcab368c0780e42557575231c
MD5 e88d25e35c433e31f02bf06e52433b94
SHA1 89cc99e70939d042f51d56198e9155f862ec2bf7
SHA512 65d270c3cf473b716c0673dfce1aa96965fdca64f7be14f17467dbb78f19d7590887bc35b28431ef646ebf04c70f12fb59e7ad54fc780d7c31e0fe066e7ad394
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 1592ea339e8ffb5ad913b6a63f56d97266973cd55d121d4742638cddf64bd099
MD5 e692e61cad87857386e0bc9a97badac1
SHA1 b51cb24bafd6597a5a438dfb3e56969fa43a880c
SHA512 f122b0c42b00defdeb2d2a7d5298820fdcf43abf5f3c32b4fb67ca293f3b08df7f195821a6d22511b157ef61d9243b76917b6ece26c0db8bd1b8a7173d47f72a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7a9d50f9eee01ae52fff312ad615e2be39e7b648dd3f85c0dce7251d1b2c0eb7
MD5 c1315d0ad73748b6b9895ad43ccf173b
SHA1 648000279a6ddeccb55328583fcd8788eff5103c
SHA512 828b6c0e0107b0ce429e2f813ab5b307a59a9071f3bb13ea71477d10329faaad526d0d3e486d62f3debea070f0119ed736b5658a9c083dbc9c721b135d2903f9
SSDEEP 96:nuk/AdO1p3TNwpvWMoiVmdexKu7VT5i5K6YExt244Yav4UWQyV+VD7AiEwb:nuk/BTpGWMQu7N5i5K6YExt247rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5872ce095e9c243bfa738f6c64c8021db83d8d36a46e8c737cd3c6aae7bdc2f4
MD5 162325e9f8a12681746c74ef0f7e91ee
SHA1 bb7f9902ca28b9d61c859df8820ec6f688ede847
SHA512 cd387053906982f5bd199fd1898b1ad763c5365834b1c592ae223f424fb66b4e5286288ac56e4ecc1ed6df7d4a37f5c7fde6fe5ba433478302455f60f4518c75
SSDEEP 96:nuk/2dO15fTNwpvWMoiVmdeH44YAv4UWQyV+VDCziEwb:nuk/DfRGWMX4hro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a87f9b79365c6418ff805d4cf4d6e0f7112db4ae8afe39cd15c33bb953663f1b
MD5 a0d70bf7dd29c6718507d39ff39f4380
SHA1 47030fd6a34adad340450d53595ea2184ec39f95
SHA512 6ca7bbe97a7344c3985c14c58b6f63964e7b9de5fad7bf09b21a47baa7379e31375c973c133a280e6b9ac137f7cbb7596d3f3668bd289a5573e718f297f81d95
SSDEEP 96:nuk/odO153TNwpvWMoiVmdexKu7VT5i5K6YExt244YAv4UWQyV+VDCAiEwb:nuk/JfpGWMQu7N5i5K6YExt24hrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f35211a97fc03a5620846e8e7c1848c6546431345fd1037f18e8407e9c440963
MD5 12741b9a89579b5c7cec2ad73700a5f7
SHA1 ecf719e0fb685b0988559d2ee7999f8d752fded5
SHA512 982c7f2cff4d62fcc84754a70330016027da537efca1e16305b61457c05b72e1155fa1cf9b0ff3019296247836dac73820738d15c0dd3dacfba5681e92a19770
SSDEEP 96:nuk/AdO153TNwpvWMoiVmdexKu7VT5i5K6YExt244Yav4UWQyV+VD7AiEwb:nuk/BfpGWMQu7N5i5K6YExt247rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 706B
SHA256 a3e84c6db5d035ca02dfab98afa52152d805094abc468358ebc72b81f55afbd5
MD5 ad221849b02377c7fb9749a604322133
SHA1 9acb118b1eec2a852d22c0b40ab49aa26b923b25
SHA512 4bfd8db419eb84928d6dae03ef45cf6da6a4cf506a56c1996503bb62b86da1f9d70e24fcdfb2e8e2b77a4edc62b97716a898e6cdcc2af015150500063d3e1234
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c9d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c9d8.TMP
Size 706B
SHA256 2cf7aedd86df8d4ffeea6b89119e0945d700b3b1ae9c23d7c6ce1b628e64a7e7
MD5 4465716fa9460cef6767bdc362ec9077
SHA1 efacedc7a29afb1388efc5f941542cf8ec1e6bda
SHA512 3a2c4b697313842fa4b04f77bd8a91cdc229247533f967b596aa4b75b5e8bd5bc21d1d65f7d7d6b8acf308a59e4b45b9d4985679a994de773bd2ce0f4559dc6e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 99248145664bfac4ab543479da9865e6cbf78dcebb691fa2492ea984b864ebf2
MD5 9cfb599d408ff58ce40d01e04125b0a5
SHA1 b175328dfaf65a0807c372c7f431b5f63dc79e91
SHA512 e100346cac37cc2ba45af703ef3229eae53dc60432fe83cca5640fbe31a2133ff9f871f818c4b7af2c65d427a95cfa7f2ef0c431cdb86a29eaf8d2fd71590ace
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLe2RUzOkmIcM/bo5Zx70:A9iIxuERzA83h09RZxYb+PqZx70
MD5 SHA1 SHA512 SSDEEP

Submit Download