477fe8e49c6a639680b8340d57c9c8c6294e2a35f881b240213f3632752ba118

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8084fbccb2351396209870f175d197c4_JaffaCakes118.html
Size 540KB
Sample240529-m5f3jacc91
SHA256 477fe8e49c6a639680b8340d57c9c8c6294e2a35f881b240213f3632752ba118
MD5 8084fbccb2351396209870f175d197c4
SHA1 ce29b1373c1ce22c1077f56e71f7a922397a7ecf
SHA512 c7fad2bb8bf8664d4c6d9f26959c03027cdc06843c8587b1b98d895fe71552feefa5ac8c5de74a74c80dd174d94a46186ac055e4a577f069e1109945a9174f7f
SSDEEP 6144:29ppHz7sB+GgMAMzMCZs8pIABRUVNi+sJV9cHY:O7sB+GgMXBBRUVc+I9OY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe
2992	msedge.exe
2992	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
2128	identity_helper.exe
2128	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4908	2992	msedge.exe	83
PID 2992 wrote to memory of 4908	2992	msedge.exe	83
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 464	2992	msedge.exe	84
PID 2992 wrote to memory of 1900	2992	msedge.exe	85
PID 2992 wrote to memory of 1900	2992	msedge.exe	85
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86
PID 2992 wrote to memory of 5004	2992	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8084fbccb2351396209870f175d197c4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b7db46f8,0x7ff9b7db4708,0x7ff9b7db4718
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2616 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6993805896868114857,3998689819602239270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1328 /prefetch:1
  2⤵
  PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 b9f8a9804c1cb62e4e97020f3743a7129ce20f7ed5c04249440e89d0d80ba1de
MD5 8df567c41b413878b9d21adee28c7ba5
SHA1 42e319f873672729fd735ec76b10e422024b202a
SHA512 ed7f084039b1b9312ef586c526c6c38f9d77bb31fe0e7b11b8e77b9515fc4082d870d9c6a0e89b168dbd909b39fd113533042524bedd34866d93047ca681f20e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b7cff7907c50beef250bdcfdb106443d7118f93af06e7b3e228eab1786b46f31
MD5 5748bf0d96e6a231274ef13e22950142
SHA1 1ced2654bc806158094df86c4446abbb8eed4ed0
SHA512 2ce7def4da4baf854c1b3aab16d0f1f062522957c8129741106270939f5c076a04d31aa81ef680fd2e912567178845024b9e23c68b7b8abac9a2ba1f0671ab98
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 19d92c1370be739f72241341999270e2fcedfe377bdd56d395e954ef88762e28
MD5 ddb963a6ac012fec341e649b9d62df31
SHA1 042f23338141849a92b361e8c3568bc4986d5315
SHA512 ff1a0804ed0f135a6c21239e0cda27db1558eed3485dae4be699300be4717e8f70abed80f5d98f085caeec2fdd4117ab94e739dfb8792c7c0d505e1fa9c3705c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0c556c07987a6261f8c59dfeb583cdc3d5932c0b1b4848ac6a36bbaf892eb06e
MD5 963328ae56207715597936291818dc62
SHA1 7e0fd7aa57c083b173e8a0f6be00dd574e3b06de
SHA512 fe5f08d52c8105e834b1c989d750bd4da55aae9a671fc37891c6d1d27918abfa3dc86c8bfcdc91707e2ef3d155642a4cd9550217901c4cf415a5aaf7c28f5b30
SSDEEP 96:n/kyf1I4juwpvWMoiVmdeHvSSaVUWQyV+VDCziEwb:n/kcq4juGWMXcVro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 52d1c2e61fea02e7907377f4e77e7e9424394d386ae2fa503e48875a34f7f03b
MD5 367b4359e199d86588ebbde807e41519
SHA1 f3fb0ddd5f1a24df72782f280ac307c1b1415017
SHA512 f6b31c510aef485fcbc2003dbfcc03736d824d4fe92cb22e681e06e2470ff7599c487e191c63409f2da5c19d1ba14b92468c44be2c3668db2096e735fd6b2573
SSDEEP 96:n/kJf1I4juwpvWMoiVmde8ykpT4s2vSSaVUWQyV+VDCAiEwb:n/klq4juGWMMykpT4s2cVrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 14c9c017828ebe3cbf81fc052c58e81efc3f587ca902b9cdc8f2f35a78d2bd4d
MD5 684c1d47fec57a0676c8ade2d9b83164
SHA1 2829bc9777ed9a79f952eda446ecdc436d091620
SHA512 3e37e8a51d35370f2c1551e78df014093ad744123a59b9d89f77afd99d1e4ca37411f8d6b7a6104f370539ad9ed469fbc20bf18a2eb122491adbf7217f6be41d
SSDEEP 96:n/kJf1IojuwpvWMoiVmde8yqQpT4s2vSHaVUWQyV+VDCAiEwb:n/klqojuGWMMyqQpT4s2JVrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 4bf75baacb762860f53571bd833533e09b4570b7b0f50c652d401eb2471c3674
MD5 1d1ee6bb8c990d6b81aec8c8539b7d98
SHA1 24beae92ee14c32249a416b0aa90cc973fe3c8a4
SHA512 b37068f040e68b1b97ca41950c1918aa56b1c50ffe7e0464de02a7fea33790dcc4fdc594402e3d339b42291a483f28c5622db3f983eb4a9ee6401f5560144c67
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe582006.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582006.TMP
Size 204B
SHA256 cf4fc993339ba553aa3c450cef23ad71a712d1ab29167f22785b194cb9678a66
MD5 28e8ff1e2e493c92c9fc22de21314b51
SHA1 1fdddf668969e9ba341c6e908ba8d013f09552d1
SHA512 9707060c89474b65397614a565a144846666196d3d5be9a1bb58525782b74b32e5ac39862dbb9e88e8668cefae3880f9d42ac71f811414e1bbd0316c32e96743
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 262d41a613d730c9a440c75f08f953baed4644c20954bbd16a5079c047fc949e
MD5 ab9da54f71a24d6d29c0c49a2ec64188
SHA1 715ede982b9331d5204fd0b86ac04b1493782a23
SHA512 f228d8d8a306ff73687b4638e4df6cf6b2ea3c4d2af9bf75e0bea0fedb2015fcb250ea4602cd98e5743287a7b5c1fc2d347685fc5fcc94b0acc2b46cbcec2b5c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZhe2RUn4uC3z2OMDCRHqlc:A9iIxuERzA83h09RZxYZ12CaOMWRHqlc
MD5 SHA1 SHA512 SSDEEP

Submit Download