9c72d8dabbdb323b43d035b3a6a5b52b697dac371eda08bfe928016facd05c92

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8473ef98c9e31099e70e379212a1eb08_JaffaCakes118.html
Size 91KB
Sample240530-rpc36abd8s
SHA256 9c72d8dabbdb323b43d035b3a6a5b52b697dac371eda08bfe928016facd05c92
MD5 8473ef98c9e31099e70e379212a1eb08
SHA1 03b2d7341a83d1a17cb22de6f997c7974fc0f3c6
SHA512 245cbd605a758d0688314159b8f1a4bda8e844c57733b7b2a464330b477eaa9b04ba9d25925f0fb84fd2a1405a85216cbcbb10034152a8399e75df81adcd57bc
SSDEEP 1536:jliU6ELJSDtRwClRzYUajie11jYItrqtiXUZjxauSDCsquqFoquqwOJilpmV6Dqr:JRLJSDtRwClRzYUajiONtrqzZj01DCgC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
4820	msedge.exe
4820	msedge.exe
2284	identity_helper.exe
2284	identity_helper.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4588	4820	msedge.exe	84
PID 4820 wrote to memory of 4588	4820	msedge.exe	84
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 4952	4820	msedge.exe	85
PID 4820 wrote to memory of 1484	4820	msedge.exe	86
PID 4820 wrote to memory of 1484	4820	msedge.exe	86
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87
PID 4820 wrote to memory of 4904	4820	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8473ef98c9e31099e70e379212a1eb08_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffa597346f8,0x7ffa59734708,0x7ffa59734718
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,462725315698683210,11462624867115112554,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

004db8c5-6fde-4360-87cc-371ada2b1771.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\004db8c5-6fde-4360-87cc-371ada2b1771.tmp
Size 1014B
SHA256 d8cf26d2790ab4d538f907b52cbd27820b67279e3057dac29b87696843e0e93b
MD5 312d29b5dd701009be8cb6f4bfe0e2c1
SHA1 349437837c2b4001a88a3454d1c89268b2438983
SHA512 fd5f6733c3821b3524bd2ae41aaf91a447bb1c616b10ed0961978520f74f465bf11a8e5c87916b159a9b1da95d3eedcaf1e59efd5711decb07fd8251cf4c8260
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 9fdd7e2caf605b531c15032a59e27b1b134d4c05d918e63105e5b7a3456486ed
MD5 a891a4b72e514d170cefe5ab2b17be03
SHA1 c79ca6297094a320b5aa5ad1e283650b3858d061
SHA512 56060a7cb97b33675422fe1f8f9c8d64aaa4ddbaf451172210dd1bd4a693e13b4c7c3759323bcf0dc3ef600ab0539a630148ffb7c1f85eb0191f1480b0dcfc8f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 7abdf14386c087d5b2cb49a93693c84cab058fb5842456eb8d9edd4f625e4c82
MD5 1f0e366c68dd62472d2e5d36be1f0ffd
SHA1 75ba336434b10e02420e21280a38893329210354
SHA512 a63e071147f379c81746e405d5e3ed740411224d0a4b7f500b5488fcbc63798c637b9b1d8c10594c8cd6b220aa913fad53c53cb2f98061480fc9c3c7a07a9fe9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 dbc1f9dfd23f9a0d9c8d9bba9baaae54c1047ea21b273ff1b5272efcd09e79b4
MD5 1e4abd511de6f350c60e61496c1f94d8
SHA1 852e8c4356d9d06a54184deabb1c9a4c8ba1036e
SHA512 c9b47d9de391729197242e5be8d565efb9fae4dc17dc0b83623946dcfd6bd4b71e56c38e0cb5e5909b1678fbcec1ea487d5c1297063a6e611f1d6f0086bf15e1
SSDEEP 96:nBJkoR41en3wpvWMoiVmdeHplwtaPacedJUWQyV+VDCziEwb:n/kPM3GWMXp3Xsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8147507887d5d3b5860bf859d8566ba91e044ec5daa3aa0db26858189b7f47dc
MD5 69d332bcf1dc031eb9136888c0be0d4a
SHA1 0398020ed046128237a903e7087c4073b32a3181
SHA512 8eb04f0ee785c83d5a868a208aa824a7e6488b1f457bdb2f93da55ebc0eceb62c1d47ff2bf9cc6d03aff187efaddbec1d1ad50d12222d3a493d112a7b4329ac0
SSDEEP 96:nBJkDR41en3wpvWMoiVmde048GIbPSqplwtaPacedJUWQyV+VDCAiEwb:n/kGM3GWMbKKqp3XsrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 70108b84731d27193884042a4e2d0ed5805a42688057ef819e1ed12b5535de9a
MD5 ce26f9e11adbed3f3c651c9590f9a10a
SHA1 5d7cefdb7dd7f1ed5b0ebf6967a5c1de9110f4f9
SHA512 ae529010262defe2ae26d9be0514a4d3158894a23bfa70a31556b4377501e8ccb990c4f063525c0cd1b327221bc5fd540f2e5cfe09082f2e99bc1fc223fb1684
SSDEEP 96:nBJkDR41ev3wpvWMoiVmde04SCE9rIi8GIbPSqplwtaPacedJUWQyV+VDCAiEwb:n/kGMvGWMbjElFKKqp3XsrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 575fa58d4b0355e32e8312d959f4d65153a04ded01d0b854f6cc44dceb97c734
MD5 bae7d43c2f11b73ed0431e405169722b
SHA1 a2be85b2a4d3aefb410c0e2a2c453d888854853b
SHA512 1ce9d09b3b51845b621938c02f6568d84ce46e315e273fa1c88c5f1200d206f83b4e5475a60b7adeede627ee8850d610443238c2181c4462775ec88ee874f04e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe585e09.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585e09.TMP
Size 537B
SHA256 057ad33850fb5ce0d458d443180e71f2be226474d718c4e3cf0052990a4b5b12
MD5 a3829cd6c039092427932ed2abe32d5c
SHA1 78c3a2509c77eab64cf39c320f2a412aa074b2d1
SHA512 3ead8bb428b03f0c7f69a19bfcaa4e1fb5f7655c12ec635343e52fa4fea8f00ae7b1ac30ffa71aeddfb18e2b5b0757393d82e1c8f69b57ad04e354236682a9fe
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 97ca3f5095881c1816abea9aaf4878a6d9e80712542f8d18edd93c9e89b645f1
MD5 a9d8949f72711da1b18fc000c82ea53b
SHA1 7abc4d1b57f52c7c7414080859d1d4e90cdbe6cb
SHA512 aea47d65bb95721ccddbcaf1bfc7608d34a80b30bc5b86647273b118ee0908e712e98b4cd8c8dd8d47a06a7815e1c6a7657bcb3d363162ea8a4ff0ddc3b7b935
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVQ6e2RUf2Zm3z2OMDCRHqs:A9iIxuERzA83h09RZxYjTmaOMWRHqlWL
MD5 SHA1 SHA512 SSDEEP

Submit Download