6e2d4e0deb8716486c78c65b31328d256552194fecba1512ddfe98a865b6a489

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2024, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c3bcb0b993bdb7dadb3d236b43b84e1_JaffaCakes118.html
Size 132KB
Sample241007-jb4d7atcjq
SHA256 6e2d4e0deb8716486c78c65b31328d256552194fecba1512ddfe98a865b6a489
MD5 1c3bcb0b993bdb7dadb3d236b43b84e1
SHA1 1a23ffb4afbbe223a94985a73f0ef4bb5f44cebd
SHA512 092eaf216d3581ac996ad48325c5c4cb5cf08652f3e84bdfc6c5588ddab30683d5f00485618b5909b8fb1d8242a8e67cdf9e5792348696aa7868ed0c42c96283
SSDEEP 1536:bKJEEJXFEEZCDrnDD9BVZfkj/f5w4w+ih:bQJX6EZCDrnfVZfh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4600	msedge.exe
4600	msedge.exe
4088	identity_helper.exe
4088	identity_helper.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1580	4600	msedge.exe	84
PID 4600 wrote to memory of 1580	4600	msedge.exe	84
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 1852	4600	msedge.exe	85
PID 4600 wrote to memory of 4784	4600	msedge.exe	86
PID 4600 wrote to memory of 4784	4600	msedge.exe	86
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87
PID 4600 wrote to memory of 2140	4600	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1c3bcb0b993bdb7dadb3d236b43b84e1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd101246f8,0x7ffd10124708,0x7ffd10124718
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6257179089537495888,18236682445491101944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

867fcb38-ff43-4293-af12-41ce13bec18a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\867fcb38-ff43-4293-af12-41ce13bec18a.tmp
Size 10KB
SHA256 2e6a6447228a0a92133194d142ecba2c4a0808172d7c7f8ba3c4794576a45ea1
MD5 55c49521aee87beea8027358ddc1235a
SHA1 67fef342618b456dd54f5ac54d020818b44a5589
SHA512 983dbcfe94c532bb6c8e34cf19ebf5a4c93a00a43045fa6a127c2a00dcd9ca80df70275fa4a5147a11f689643016421779c7009ef5f891bedf3bad18830569cc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/0xe2RUmBkjTIcM/bo5Zx7:A9iIxuERzA83h09RZxY/qa0qZx7
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
MD5 e4f80e7950cbd3bb11257d2000cb885e
SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 595d88faba1d08f21b629aadd644e9505c297509901da5f413fb4e4d578546f2
MD5 d03d27f98c2fd40776bd76ce62eeb460
SHA1 8fe3a9700c087ff17c2369927062feb2e41fd8c5
SHA512 eab8ea23f1c511beb56526e042b9482e94b79c07967e0ae5158ffe2f3aa6a71d5c64420e0e10a082c3a1e901da6ce54443f6fd02d5de0d6d84c7fbda76f4bc91
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 ca82464dde67b7171a55d73962135f526e253650517c0a28fe2155e00aca83b8
MD5 af641dfcb921b7a05fd465bd9d8f4198
SHA1 ec4aa80ee9525da3f9be41edf0e61137b57b9ebe
SHA512 fea8cefa7029066e76328e4ad0b2509e3714eacd0545c9828e4dcf51642f4f614bdc97c3a24ea6c6afb43f8aa4b28dc0716d4c1309c5e829a240bb2503cb000b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1c31aa3236090c56baf5d5c6da8572c75e9b2228c4d6471c40b03ed11e982b87
MD5 af490a09702ddf45b6078b05f8f9dabd
SHA1 929c6dd1eaa2195cfe2e1e4ade67f6efec600e6d
SHA512 32a8e6e95ae5a91e6ede235bff5f2673b3e3456bc392e3fdfe8dbde93c0c58691d95a8ca0dfc6caa599cf23af68f7162bef5a48d5c211931e5a77d3ec27cbd7d
SSDEEP 96:nQkzTa17RdITtwpvWMoiVmdeUe5N8VyDK1M2TbZoxUWQyV+VDCAiEwb:nQkz+9RdWGWMEe5N8YDK1M2/exrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5e8616e8fa22e80596fae05aab9edff8f06e08ab4fcc8c99d99988f26eaaa599
MD5 c4c17ae67b7c0b901f1a4d10aeb08b3a
SHA1 dec653cc83ab91417d8f1234e4e871dae50505b2
SHA512 45eda1f2fe960491187f80c9604a39ac11db511071d46e00f8a9f566a0ca14f3c8bca384110dfc1544fa0d7ecc43bb3522ba4144053c49e6bb4466bb14dd54c0
SSDEEP 96:nQkzza17RdITtwpvWMoiVmdeHTbZoxUWQyV+VDCziEwb:nQkze9RdWGWMX/exro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 5f8b1fa2a634d8841e51f338ab22610f9913069e83e7550b589c1884f8104c79
MD5 c41120ab259a2850d2cc4ffaa0cdbc8b
SHA1 5a0330c25735114bf7744c3dd6dcde0e1fdcb429
SHA512 aeac6d5e5dcc764d50bbcdcb415cd6e7b3343705c1edcc21bcb25e90ae51818f6cdbedfef8a166692d57795d5dd1cbc3f859cc6bab0f9b195a95bf95a2f79049
SSDEEP 96:nQkzTa17RdeFTtwpvWMoiVmdeUe5N8VyDK1EMdM2TbZoxUWQyV+VDCAiEwb:nQkz+9RdCGWMEe5N8YDK1EMdM2/exrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 a8355f8c5e21fea3b349e1f7f637af83ac0e00091133faccec8898e870b5682d
MD5 575bb86785fbf3d576cfab43ed91106f
SHA1 641a0ad422f29998715a4121d35cdbe0ea9dfe10
SHA512 b0ae09d7bae646d25d88791010b37f16ea427f1d4e76b0ff1688e4d9f79bdef15939a30668721e42c4c0a36c89ea48d9a56371ca4ac292e2c6ef050a52a6e37e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57de98.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57de98.TMP
Size 874B
SHA256 c3d18218931e0a57c1d35212f4ce68e46f3e571f9cf294225febb1e51d8fe110
MD5 9d6b7bdabe032cb249ff4e7b4df7e2fb
SHA1 58c032e5138496cc9ca37141c387255cf1cda0b2
SHA512 2098b51107502558bbb2ee3c11b524fd7ec09f28b7173e3ffe26fa5adcc6621f7232d29ff431f7b0d3d8a11a0fb207284e458577c123c0ef5f2426246b95c32a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

f693d677-d716-49ec-8a39-e88bbca65156.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f693d677-d716-49ec-8a39-e88bbca65156.tmp
Size 1KB
SHA256 b809b4a1eaa376564fec24e45fc5f4479ce6399798d8c8dda1fa13bbaeaef8ae
MD5 936a6ad844b74c98031ee5c394d15fa5
SHA1 97eacd70b5aa882b101e844f265ada0fcd820a0c
SHA512 a3d80d878503983b6206aec1bad8f7ecc4b3edcb101cea3a7f38ca659f6074d4b4ce81e649d32b89a49c428110417180a4a8e4aef8e8f17fe143df9b801946aa
MD5 SHA1 SHA512

Submit Download