be14b9585d506716b1a03d3f5e128638878d0b96620f9a5291da55e1a16385f1

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11d928815cfd568993f7ab588ad4b382_JaffaCakes118.html
Size 127KB
Sample240504-j6c6gsbb72
SHA256 be14b9585d506716b1a03d3f5e128638878d0b96620f9a5291da55e1a16385f1
MD5 11d928815cfd568993f7ab588ad4b382
SHA1 2a289edf7688f5ef3769b8700bb34eaccf25d0ec
SHA512 d2f31c655c8cc9d316c18d116f8d7a4b7b62945741543e298ff3f0a6f593386cd0436cadf8e1de1747f8ce31c69d12dfdc63af3ba5baae16c90ee81205f6aebe
SSDEEP 3072:RUrCWDxYxQ2PDxYxC2T/Z1sAoErNu1SeOhzSNE7jzCqezZS3HO:RUr1DxYxQ2PDxYxC2T/ZF6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
2364	msedge.exe
2364	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4712	2364	msedge.exe	82
PID 2364 wrote to memory of 4712	2364	msedge.exe	82
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 3372	2364	msedge.exe	83
PID 2364 wrote to memory of 928	2364	msedge.exe	84
PID 2364 wrote to memory of 928	2364	msedge.exe	84
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85
PID 2364 wrote to memory of 2436	2364	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11d928815cfd568993f7ab588ad4b382_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb44b146f8,0x7ffb44b14708,0x7ffb44b14718
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12233899153774024396,1325067831144653736,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 b4e5a521592dded64e833ef774c91dcf5f27c3f77dcc7ffa2fe31b42a93b074f
MD5 193fd0930066697bada202a2ae7f9676
SHA1 c127f9397b89b3f5c539496ca7a25e39ac217da5
SHA512 cb0de2c3132de64f62d02a83ae34365fc5d412a360ff48d0aa9881a1b1449e9136886e52a49780640f2ece3d8353f30a796d6e5d2174cfe9f10b4f060550fdeb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 d24aec0f6e29239e28985e62bd8256384ddaa49cd1ae86034896731a28e0be42
MD5 fc84d8ade18ad3fb80bb6ffdffaa90fb
SHA1 84d0182c705c9803c4f9fba652304c5234ff92b8
SHA512 d832c9efec7fb366862fb97bef2a1bcf86d16239d457d5f79bcb7b8e8a7b9b618a93488a6b1b26c1dd9824d592e2b9bcbc26183e4347c5a63c950b82d3433213
SSDEEP 96:JLQQzC2gJ6rFV6uWG2GiGvGhGCGNG2qGLG1PGaGfE+l:JLQYC2gJ6rFV6uWDb2mdOm6OP/NM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 aa19627ddb855c7aa4607f4b1d06fa3672fccc5a783822730675b9dab7ef3b21
MD5 08594a01e6ac5ab88d88da3ef58ab741
SHA1 9d831f524e6257b0a4b718988a91562acff0846f
SHA512 dc5857c1df5dea804bafdbc57d6b28377eb7d5c5299d8384ddfdaa50fda364139b0c0fb3abecb4fc8a676e4c02f3c1d0ecd274a0859e2a6835e5691ed59b5c40
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4ff8670aeb2423cf049ce8e919813046d49840f42c243e04973c5ee800f2f292
MD5 4b24c03efd21028cd775865a36ba18b1
SHA1 6f277374ddefe213d5e50b5709d3d5a5a24a0ab4
SHA512 b86dc6b9306c5ef72cd5ef4b1366e04749b2e05d8db26bac0fb483396f4d198d503b7fbbcee9f6017b19b1084fbd482ad2ccb602693a6a8fbf1921feac9b9269
SSDEEP 96:ntk4xm/eQYmqF1S+Oga9IQwpvWMoiVmdeHpCr4bzUWQyV+VDCziEwb:ntk5HaBdaCQGWMXpzbzro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 48e4ecb4b87d71855d8bdf337df636c84f7e0ce700c4da0886bf28cc12fdd68e
MD5 8d1dba091e0f18018f3ad4649d840db8
SHA1 17d04be77d2f1b792ef41a6714577bdd68922c91
SHA512 32ce3a8bd7e8b8ae8abf700f1bdb95e29d461021a41ca50a3f4fd943fd7ec62112ee7a96299eed7d7080a5e23555d4d4b48eb3dc33dae2b424bfa85277d49f4d
SSDEEP 192:ntk5ZaBnaCQGWMJFj7FIBHcY9T9GjErVdPAs2pzbzrV:nt5BnRWjFrEN
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 a2eecc01650203919ed9afcb572d6cb7ba1c9a10c0214772970e295e8181c5a6
MD5 7f7239dce99c650ebbbc49eb56cc2bff
SHA1 d7ddba1eadb21e5394408022c77405bfb1db0fd7
SHA512 8dd0d08d66ec487eb224eead4438a88335e518f794f4edbbc1f523170cccca05ac3884fa7d2e76aa95af9e336594bf092b24cfe7960616c48673950e7f2fa5a3
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe588056.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588056.TMP
Size 371B
SHA256 e7a933d0ce86fdbc0512eabeb2a21a52b843a8d5c7b6f9d955e94ee2515a61bb
MD5 32ab5b856ebf19d1ea5465d29333bff9
SHA1 30c058bafc8d66d8855543a5453688cea196f361
SHA512 becb57fb81123068a1b17dbcc41bbacaa9abaca000317a66223dc53458b071a8050f2730963663d2fc562bbba4c3affa1444198bf38fd2373803d9c5d1803f36
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

f7811047-493e-4531-aad5-eab114a87018.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7811047-493e-4531-aad5-eab114a87018.tmp
Size 11KB
SHA256 dab4b69362087963aeca0c954144468ab194090c2ee1c6bbc62fd847072827f4
MD5 46d4a26c98a3e66a5914f17d71674839
SHA1 d4400aaddf13795039a76142d6c696cad4bb2bbc
SHA512 8e444d57325341f729003937c8d08209343cdb9ea22cd8650e9b466c9a0038c57100a98a3a64668db63f23d76fc5329dbe441ebfc8754fc96fff5bdcdeca98b8
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7Fkie2RUIjf7ZXn+OblfBj:A9iIxuERzA83h09RZxYJkc5zZX/XDafQ
MD5 SHA1 SHA512 SSDEEP

Submit Download