522d2573306756ebc2bc36ca4ef14dc8d127371171ff9e81d47be5806a92f074

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
911d6dd0fb5667797399d2785ea4ca38_JaffaCakes118.html
Size 125KB
Sample240603-kce9esad28
SHA256 522d2573306756ebc2bc36ca4ef14dc8d127371171ff9e81d47be5806a92f074
MD5 911d6dd0fb5667797399d2785ea4ca38
SHA1 5ff7b0bc0b776cf5348951b404b3a9357cd64ec3
SHA512 e9299cbe0cc35c8d20102893cb26bb9e18e7da014f8cb3221d5989e23de9c0282575640c695f61e9eb72c872d0273a0b77ded56e4ba689a9cd047bbb68cc56c3
SSDEEP 3072:vBT3QQzgjwwY7M3vO4ebBRgn7hGqmBLygFBnIvl4:c6B
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2060	msedge.exe
2060	msedge.exe
1124	identity_helper.exe
1124	identity_helper.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3100	2060	msedge.exe	82
PID 2060 wrote to memory of 3100	2060	msedge.exe	82
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 4796	2060	msedge.exe	83
PID 2060 wrote to memory of 2996	2060	msedge.exe	84
PID 2060 wrote to memory of 2996	2060	msedge.exe	84
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85
PID 2060 wrote to memory of 2744	2060	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\911d6dd0fb5667797399d2785ea4ca38_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc77946f8,0x7ffcc7794708,0x7ffcc7794718
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1260 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9611384750171989165,10825552904047746064,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

01143a48-5436-43d9-a2f1-0523e41d4750.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01143a48-5436-43d9-a2f1-0523e41d4750.tmp
Size 7KB
SHA256 af609fb3bf6597993efaa339762d4cba4d15ca31407e157862d284bcdab5d1ab
MD5 ada49497fadfccc330121b46b85c4b00
SHA1 0c4a3c8e8081ac0e45e7216145f1f520f6cb1135
SHA512 0544ee8ff666808141c6a3c23c4412a446fc55f60e0148b9d7fa5795249fca639c5450a58c5c5192c884e493e8cf38b8abb66037149b0521879c33396729149c
SSDEEP 96:nsk7L156HwpvWMoiVmde5qYF6adb2mIzrUWQyV+VD7AiEwb:nskvyHGWMpqYF6adb2/rrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

74f8d946-47f2-4b7b-916f-e92c29019be9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74f8d946-47f2-4b7b-916f-e92c29019be9.tmp
Size 1KB
SHA256 62c9086309fb3381db83ee664eff6cbb38426575980d249b05b6298b4f334597
MD5 a4a04f29be66d0f042aad6ebecbd049f
SHA1 8e6ff3e5af6338ad6542bb7f646b7ac58736b9ea
SHA512 66ba9a491b15eee3a6885dd54589e39779a8ef95085324c03fa15cf16ce35080a8108984bf504cb36902f7246a7a98a05f12541fc8c1c0a4412753a60236ed5e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 05ecd9ca7c4449b0e1747a0871f9c6b0149f4238c695731444ee98eefeb31e88
MD5 1560a5bdf9ef89df770a654d3200a391
SHA1 0afc4a70b4becf36ef4bf1919aee04b18c604ef4
SHA512 f85ebb02c754538d34a951b4ef7c1e20bb8814c6ae62fabe97805897dd672379d926840c6dbe4cdf6de1cf8c092a6f525817226c22efe33ee1fa8acc1bb90d43
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b4a4bd96bd5443257ace0e821ea23631eef71f4a5c6af1becd0fb512ce12cf22
MD5 647bb964b2bddd5387384a597d38c6aa
SHA1 45f0e08082564541480343d6b37850123781c4b0
SHA512 e3daa994e53f5548f178549643e2e0037e30062885fa45b74f5ad05268f5c7b317d1077eab9dd72e24e77503fe817d73765d4aa3e96c54c911a0a939b20794c2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d8d6e03d9b0a80e805621e1ce61a85831cc2510267d37fc48c6088b17925c6f8
MD5 a6466abb50cf2a5b24d9c507505f8b20
SHA1 461c1962271d0d4dd3442f50f089555b7ef16978
SHA512 ba3759f0c40c2dc67406a2d8267742bc61c12ed0ed03a7c723636f9aaadd6d503ed80c060637e37066a1d24bf81ead2d516d59646db7a6d7b06f4c246a758804
SSDEEP 96:nsk3L156RwpvWMoiVmder6adb2m0zrUWQyV+VDCAiEwb:nsk7yRGWM76adb23rrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d58cb3746361ef113713db6bdbc8468e772fed3ee8faa7881064633723c4621e
MD5 d9f36925eae4fa6829db15ac755aad4a
SHA1 0b2fa9553400c91c048658e9ad85ef575a798703
SHA512 16d5fa53d5217c1a171aaa732c98c781dade5017e42189ee408c1cde0af9982f2756bf1ce88926a18dc1eb2f9f8bcd4fd2c65d428e52f6cb8faf8ce58f793cde
SSDEEP 96:nskML156RwpvWMoiVmdeHm0zrUWQyV+VDCziEwb:nskiyRGWMX3rro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 91ea7c73ca8b44d85a2047d76827be6814606df5faf1f48e203fde2d7aae422a
MD5 d4abe19be4ce482e992f15c90554c900
SHA1 91c1fe1f5ff15d485cf8a37076ea6556f00e3281
SHA512 effbbac4aecd1be603e7f8976faa5c2b020820e0e32d2c04e63cfbc80f67906afb71b7a114eab19db820c11f59b938708d0320f5b7abacb55838b1635d3bdb95
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 201B
SHA256 2e6425ed9af6eca637134bba917f284510c6ed6a3be8520630b4668dd4c3b97d
MD5 dd7cd51311d48e55c60179f574d17d3a
SHA1 159dfa163264963096f44a0f90583aecdc616cbc
SHA512 e1e4ba888e912d2fe3e2881ce40be73d10ddf2fc78d8d343fa9982c15a22b27b5ed891ae7cc527903b79cafcdb30f1d1be3eeef7fd859debf57400faddd19933
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d8fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d8fb.TMP
Size 201B
SHA256 c825065f6b9ad575a1d9d087bac746df044723660aa9f2b62573226243d1c4fb
MD5 57558e08520e8bd5263393933398ad73
SHA1 4e52ed109f4cd423692df92d66c4a678c24c8a5b
SHA512 6689a590be7b27cfbc7b619a746a9e4aa936ddd9173bb3d73a83f268cce16c6a63ac2370f1cc8c6177b2140a13e25b70574a1194dae85eec1b38ba9da4ca8f76
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ff8f0477cade5d676d476854498db5ee6342f82fd0a0f7d214a12e9d8a5168de
MD5 e00b7c48c7def187e4bf287a8b7a0e4f
SHA1 1dabdc8213fa092f65e9b67fe2618b48ed26a712
SHA512 90729c11ad1579abf1a3f21883c3682cbf2c53c6ed7a1be08e253ee057509f8c53b1084977d28b03f221123b5cb1010f0e399c553fa9662f7c694143b4fbd802
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupD6fe2RUBwXzg3z2OMDCRHO:A9iIxuERzA83h09RZxYqPgaOMWRHqlWY
MD5 SHA1 SHA512 SSDEEP

Submit Download