f5ec2f4314aa987de5ad9602596a3e90d730c18d39e6b4f0d07a16c749f3bfda

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
911e5696748f858108d5b5a459f47bfb_JaffaCakes118.html
Size 92KB
Sample240603-kcrmfsha8w
SHA256 f5ec2f4314aa987de5ad9602596a3e90d730c18d39e6b4f0d07a16c749f3bfda
MD5 911e5696748f858108d5b5a459f47bfb
SHA1 e70d22a7e913eb2ef15abae1f778a2160b280889
SHA512 d33965f21a1fdbbf9a90799ceaaaeb5d1284c01c157469b660f97e1f911fc58f6ebe4791ed89c909db7f98b4971c5d846c93542c36ca3a518b09264abc90c54d
SSDEEP 1536:qM8yKEgKDW0zlNOqr7eg8Gvz/w5ObfQKImk92z9YkID2IGux6Xd2IGMwHWXbKcEZ:M+8Grw5ObfQKImk92z9YkID2IGux6Xdg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
2828	msedge.exe
2828	msedge.exe
4812	identity_helper.exe
4812	identity_helper.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 4808	2828	msedge.exe	83
PID 2828 wrote to memory of 4808	2828	msedge.exe	83
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 4788	2828	msedge.exe	84
PID 2828 wrote to memory of 3324	2828	msedge.exe	85
PID 2828 wrote to memory of 3324	2828	msedge.exe	85
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86
PID 2828 wrote to memory of 2580	2828	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\911e5696748f858108d5b5a459f47bfb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fe9b46f8,0x7ff8fe9b4708,0x7ff8fe9b4718
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7768 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12406282297604843314,6205348496694766254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x318 0x150
1⤵
PID:5896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 23KB
SHA256 e4a7b714be04434217808adab489be475c2293f5f59aaddcf3ae3dbef1dc9f60
MD5 3f43547cfdc18e5a940c39aa72e0eba3
SHA1 5105f5c293d83d4dc0930ba91fe3e7ca5be39259
SHA512 c63478fc7cde2b01fe4aa616ce8145a6e1bd7751a24b57f6cd37f6fd98588060cade4ca85eb36050a29e90377883d071953439b4c109898ca8003531278969ab
SSDEEP 384:sW3BEmgUai4inz/8WEtcTXQnm1UTJ8WEJR+HJXC1o8SAFJ1XwQz5a4mRyrBL:LBEZ9ej8kTmm1PKHA1xJ+Qz5jrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 29KB
SHA256 c48995035671714ce6c5370e077c92e7b2b7dc977a04cb546df2488755280139
MD5 c8f14a62c63e02b31f475d5ba7111e6d
SHA1 d4dea786a748e1cea3512a2367cd9559fbcb5261
SHA512 b0c074820bde3c969b8decf6579853e6c238e70f7151533a239f221baee63449bd6bd75b0f690ff281ecaa47dc3965929cef77e8a00ebe1d01c541b250a792ff
SSDEEP 768:0Y0Opr64Ev3ARYsbgWoqLD2DH9u6RDziz0EZIo26IS:0Yze4E4RtbvnLD2g6RD4Io6S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 81fa3290631cf21deff2c614f357fd7af2533a230f928644f671064533daf347
MD5 6d885d145fff8d03475b9e5128b242c4
SHA1 96b5a5e14f2dc86d5679ae7290bb52c55dbb43f5
SHA512 df02e684ba1f16dfaee548f3ffdddc89a727dc5916298ffcce0699ef48e81a61f2cb2b1483a5540cecd98137db61ea35469ef9b4919990a6fb31e25b09b5c22f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 7a5fa1baaf37ab9017510f4a8d88549aac40df5c61add732f09b9a40fd5ec703
MD5 16536ba96216e59e331a17630cca6a30
SHA1 89c3fb5a30d21496392fbf881418da07e0c5e95b
SHA512 b27120f5b940cb97fa3a991292ef675b96f568ea44dabab55d915b1e803d72d430b237e510338ae32baa77d1c5b5cbd3484a86bd0d45a18300e1866acfb64879
SSDEEP 96:n7kFq1RQjuwpvWMoiVmdeHvSSO+UWQyV+VDCziEwb:n7kMnQjuGWMXI+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cf1a11f53aca6154851530c816a2c0190d4974df910cc3a727819a0192f4ccbb
MD5 4cf88770be6efe8e1e630d3cf7355080
SHA1 ccb7c9df4a27b44aff0c45d3d80bd05ee8947a71
SHA512 1b0cd2ebb56f90f48e015bd8b0805c7af12423bd68cbb9debcfab277b165d5d9bed26ca4d931e2ee0f72ab0edca913dc08e5bf1df4166d158e51287c6f3139cf
SSDEEP 96:n7kgq1RQjuwpvWMoiVmdeHvSSO+UWQyV+VDCAiEwb:n7knnQjuGWMXI+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 706B
SHA256 982cde2b1a74df11c8a2edebf7ecaa24d2cdae76bfadeb55f0dab3e285e41a27
MD5 8a52e8f5ff387cbb924a0dfea13d7cf1
SHA1 e155d01ae53483102a7e97e990a27b976e3907de
SHA512 1563291aac7f2f8e5f67650a9f6900e0cf92649505b4b0aca961d1f169e92ad6da8842cff46138fa8afbda661372573aa75343e6d8aef16c2a7ec778bbb7b802
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 e6ebd945347ed46d5ad9101de593f5b4b3289490014241bce20c666ad2caf8b6
MD5 64a815af5375d1bd3e4670cd14faba6b
SHA1 8ebb4e98ca78bd9e2cec4a4cb0d42cdbaacc152e
SHA512 baea2e4ec093e3e127fda7dcdc9001c63ded7db266541984e5aada8010b6577511cd84c61fb36e20a5c959a1e78cfaaae2650d04892c89c46e4eb5ca75063fca
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe579e63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579e63.TMP
Size 706B
SHA256 3dde2f7ab06c5adbb27890482255fb9ec372821ea8bb7d57749562fb6e51d311
MD5 00db8bd07d5926c22ebad33dd5c4d0a8
SHA1 246e543903c5e4eb296cc390b545c48d79086228
SHA512 dc62b419495b54aa9927947edfbdfd6d63c9393cd980cbdffb8f4a50c1060c8e2445fe9126c83832e6fb5731bdcfda8e8dad65691e8a660e20a78d46aa9b6901
MD5 SHA1 SHA512

Submit Download

aa47ec48-3ffd-498b-890a-445c3e8cb8ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa47ec48-3ffd-498b-890a-445c3e8cb8ed.tmp
Size 6KB
SHA256 724442c6e7847b4206995bd3e78ba2ba0aa34653a4139e65984d6929b1c84b18
MD5 10eca4cd9fbe3816f84d2533b7fd97fb
SHA1 e4acf1d3d04c83abc06e7197f4a1f21ae91c612b
SHA512 080c0e63243ae33cdc2b1b54ce454a4239af6eca34af5735784402c125062f654d39b26bb59de420fb5e5883044498b3c8f9eec03df56b202dba5fa44264b155
SSDEEP 96:n7kgq1RijuwpvWMoiVmdejbKz8G2qvSSO+UWQyV+VDCAiEwb:n7knnijuGWMTuzEqI+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dfe6f6f2f19fc4d0f035c6fae33b7e4a682885180fee4a0800f6b86656569d42
MD5 2a9146c682d29d6567b9e375a8dcd41e
SHA1 e2425a4670c3a4f85267d891ea9fdb99152cc543
SHA512 9b49ed1d4bdca3e7ed21835eeb5b609b1e956058c9757ba90ece0328c838a3c88010439aa1e6e80cdc60610610ce4c8c67661ddbbd44ae3e8d6fef576fe8e0fe
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup02e2RU+Ru13z2OMDCRHqlG:A9iIxuERzA83h09RZxY0YQ1aOMWRHqlG
MD5 SHA1 SHA512 SSDEEP

Submit Download