a4eac3d11899085be437b89bced5ebcec6e363de20fdede66ed3aff7fb71f68e

Analysis

max time kernel
134s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
912b05a62e48a6b8a51a59face546412_JaffaCakes118.html
Size 51KB
Sample240603-kn1phaaf82
SHA256 a4eac3d11899085be437b89bced5ebcec6e363de20fdede66ed3aff7fb71f68e
MD5 912b05a62e48a6b8a51a59face546412
SHA1 1e8d034b96cf675ec4ac089448b085035a99ebb5
SHA512 fb2022c7a4b210234449b87f9d1024f73eb000bb24faf04a1da7b3d432cb0dd0791d31b532fbc0690f8b5b6a640f674a1365d94e27234423637be08adc8aa8b9
SSDEEP 1536:SOGrK7epnC4FcHRqrejfQK00ChAqhSSqEad1wUfoeDkvJ:SOGrK7epnC4mbkvJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
900	msedge.exe
900	msedge.exe
2328	msedge.exe
2328	msedge.exe
5096	identity_helper.exe
5096	identity_helper.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 4612	2328	msedge.exe	82
PID 2328 wrote to memory of 4612	2328	msedge.exe	82
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 2868	2328	msedge.exe	83
PID 2328 wrote to memory of 900	2328	msedge.exe	84
PID 2328 wrote to memory of 900	2328	msedge.exe	84
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85
PID 2328 wrote to memory of 4796	2328	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\912b05a62e48a6b8a51a59face546412_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc77946f8,0x7ffcc7794708,0x7ffcc7794718
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3457841955571530263,7303784191047494342,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5ec2c67efd185280b07ac7e0fcd61e36afaeaa7f7c799a35232da94ad287a093
MD5 88416c103b082d33f5cf5a82e32a70da
SHA1 2462820fc45c571dcaf2b57758cfdbea3304da04
SHA512 44e320f64ebb90f5877c94d47850b09fd3e9929eb411b45608b09ca152789dc51df3f104c117c3a058dc3a1741783d419c9d3301bfaad047ad29bfb93ddeb666
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 242B
SHA256 c579e7edf91ce8660428e6a2ee4392fc401043b60938b24d4b8e52bcac40a3bd
MD5 01880399c035a1c0a6cd007c40600b40
SHA1 5071ee6d0e532d18bc45371067f17fb349bcb759
SHA512 33d7d4332015dc240968cab1ca35ff746a54bc572310121d909e359294749296812f3d6d637dc7fe080ec3d5eb8de14ef6e9f63711a1825187d5164a7ad29efe
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 fe158afa29f8269b17dbed5f237676e769da1554a8e760ca0587d8c61fd4bb9c
MD5 33a70bdc1250b7e3bf2a0f16665f01fd
SHA1 ba426b515d017587f0a164e57c7da00233d1a7b2
SHA512 4b7f2bd1bbfb6721a82ad3baa49c227fa126173cf82e832a33273b9c9626a70d82b761d3954995a7254eb9f9af85360af3f3e573e15112d39c50b469b78dd72d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e5004d21c975fbb6bfc53bd01d44cf2e084709fde63132f30500a7f9c98f013f
MD5 ead3f95991b0ef631207e499b3c9f966
SHA1 b548cb62e85639376d782d74be9fa04740429ab8
SHA512 39767c71213a54a1652df3acfb48777a314a62473bdb3f745f1cb699c24e38f4ad786192f4864c9821b80b5e406a0f7ba433e92a0ca36ec24ee0521fb5fe11a3
SSDEEP 192:nsQksx8BGWMVPithMH2hX2FxM/EV29srV:nsQBx8kWGyZsN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 938b661ad08b5849243916da2f7488041c9514cd78414c1c688eb16e247d55b3
MD5 c84a0230a47139aee786b1ac14276bef
SHA1 02a5f22611c298eb4ed40844fabe3edc5a6420cd
SHA512 d3b7bad0a3a8ee35af9d0a9d4db5e84527b5b0840d4c980cc8c3b6429395600fe8e98240edb49f34fab598fe6dd94ad824355d9f2ac6e79eda077becfcab2e0d
SSDEEP 96:nsQk38x1uRwpvWMoiVmdeo2D2qm03sUWQyV+VDCAiEwb:nsQksx8RGWM42D2qLsrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 31b40338c53222ae917e2f9c129ff7f1acd5d18893bb747c6f2c449abd73163b
MD5 8072156a02495d8531659f148be5cfea
SHA1 7c345c04b757225caef87d59d4a891fa40839801
SHA512 61455389e5b16cb572c36b47c14a6073de000c90a54a1d8f6f8740b7d7aec581ea20713d5c8b5ccf983ec3c7c5c7beeaf11a83752ed4a9500b6eec4d632f1e40
SSDEEP 96:nsQkM8x1uRwpvWMoiVmdeHm03sUWQyV+VDCziEwb:nsQkBx8RGWMXLsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 706B
SHA256 3d8569ba306d7bb4b560e27d090561deaaef186d161128129ee3c2249687820e
MD5 56b557d8eddd787d79da6e65ca9694c8
SHA1 3b9c37f97f0610f166ffadf2500d9ef49ec24fc1
SHA512 b26bc0d302a2ecdf9d62bec3e07360ebf0d30f4b2a63f6b94c07049d12755b94a99d8d884a82210acc1efe69e9638756e6578eb28b6c48a6aad2f72b6a41e9e8
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe587932.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587932.TMP
Size 372B
SHA256 3ba4767bd8f4116e82dd3cebb26449654a27c47c0671e7f32c549ebb1e50724f
MD5 5bc7659124c01a4b51d0a0011bd47727
SHA1 4e002681153b5d26a42e061c8b1b3ff27ca324dc
SHA512 74ed69e9948cb269c92ea9788f369b80f4ae903500a73acf04a6b2f2a9622b24916987b6023fab5e9a4925cb00a1743b656c5707517e1dc0de13d0c00e9f7dca
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a37fd92041bf0dc35b0defa56bd8ec23ba8188e1760d6012d9531afd6ee309cd
MD5 0ee134f01f6c22831e1e6593a0c5246d
SHA1 2f78b47dc244011ec61bcf7f37a857c6edd43ea3
SHA512 a7b470cd59a0b0b574204867e72c821c681effb682905e0dd713927bce0ad390c4d84fe06bc5a43b182a118e56bfe692b7589974374cbca97b1023b2af988822
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupH0e2RUYYgXzL3z2OMDCRHW:A9iIxuERzA83h09RZxYaaILaOMWRHqlF
MD5 SHA1 SHA512 SSDEEP

Submit Download