8b51d657fdc3345564e040384919a2b05de225e5510f87b624517c2258403d50

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9170ed39eaf9b26a4953a13a39db1993_JaffaCakes118.html
Size 18KB
Sample240603-mgbsxace33
SHA256 8b51d657fdc3345564e040384919a2b05de225e5510f87b624517c2258403d50
MD5 9170ed39eaf9b26a4953a13a39db1993
SHA1 9c94c6de021a9997ced614b562e7300247e28339
SHA512 45ff13c8cca2ad22166ec5556263301719ea7f575de04e70ac920ae690d4ae7f80b39e726178efe38c5db97a97a9647c93baef416b600263dc8b291732efc98b
SSDEEP 384:sfRIjUDGO2G9kLL9jp34wRBeo3s0Ma/olSoCYtoxMKxvejnNBWqTeYvs+IXaIdCU:sfRIjUDGO2G9kLL9jp34wROvKx9TdC1S
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
4848	msedge.exe
4848	msedge.exe
1632	identity_helper.exe
1632	identity_helper.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 1308	4848	msedge.exe	83
PID 4848 wrote to memory of 1308	4848	msedge.exe	83
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 4048	4848	msedge.exe	84
PID 4848 wrote to memory of 1416	4848	msedge.exe	85
PID 4848 wrote to memory of 1416	4848	msedge.exe	85
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86
PID 4848 wrote to memory of 2988	4848	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9170ed39eaf9b26a4953a13a39db1993_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0ef46f8,0x7ff8c0ef4708,0x7ff8c0ef4718
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2920 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15440851482631548587,6553864190640800872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 460B
SHA256 24aac0de31e8c51b7e9b6d21ec1e00aea334963735d55c567055b308ccc75b6b
MD5 0bccca73ed7e98b5720a4f26075954ce
SHA1 1977759699a8e9c58e1e4000768144cc8bc99fe6
SHA512 13fdc2e1047e69bc6349131053126cfe0ac07f41a6154880082ff73a00b279d202e11824745240cb802fdd3fc9dc626c57d2ee0658a7f4f03df37d6331718af9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 386B
SHA256 547b8ea5064f67d6b8cd19b3dfdd353b7e97070532aed81723a21ccf2f177c8c
MD5 609ac0059a08775b37ee3c6fa8d7665f
SHA1 1ecaab41832c2d530b1db0f5697ee3f9778c4b58
SHA512 285badb84dd2c5b101a3a78e489d3f08465c1a1e0be15d4fdcce92219bce5d6c9867b37fba3ec1b16a35d9ea04f394336c0f18cfcf5d51540af0fedf8cad039f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e9b346378404105fc7040922dfba81317c950955807996917d006fbebfd8d777
MD5 57eeb37176e2f5122d5071603ac73956
SHA1 eca2f0ad77083e4839cb1d0251df7d754f3e2236
SHA512 d21846847afbc34a60b73986755f2f3fb55758314f984195e17e7ae1d81e21fad3115739f9d1e1a8bcaca740393ef1b8803d6f103299745b235b6f767c37fe2a
SSDEEP 96:n0kRz1s8juwpvWMoiVmdeHvSS1UWQyV+VDCziEwb:n0kZi8juGWMXzro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ac2bd60c826fddf746755afe2c75ed488ac0b85ed50751e0704054f5aaa1d95f
MD5 74d40a0f9da994ebdb6769442452f448
SHA1 97cbb809360c58d862dfd39861945b288a5034a5
SHA512 9605b1426e47e6620773287b128b392794236b3afa9e9e206518b4e79e25dbf27dcd6d9e6828980b167eb76767437c794c96b5c4e97adcf4a3692dd3bd4512ea
SSDEEP 96:n0k8z1s8juwpvWMoiVmden2vSS1UWQyV+VDCAiEwb:n0kai8juGWMX2zrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ee07a09beb15f1b2a1ff98e2816c8b363a8a3302bd844600120f1d874904005f
MD5 86cd822eeb517a2e5db26ed8f62e39c6
SHA1 e0004574b19c4c63a0df90263ea2dec6335864f7
SHA512 573b55465abe24fa88f5e254696e4e0ef1a1ba748983a83c35131dc5ea8f047a8751a75570506193486f6113764f7f86138480e3d045fc009bf5bffe374ff53c
SSDEEP 96:n0k8z1sjIjuwpvWMoiVmden2vSS1UWQyV+VDCAiEwb:n0kaijIjuGWMX2zrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 98254877e01cce7fd4fbb3f93443c260c38c315e921524bc6f2c256796ad3ddb
MD5 20ab8917f58bd3383a54ff9fc34dee3c
SHA1 565bd5293da86db7f5f2560f3872d457b0d9765d
SHA512 b054decb74a759d7ce82b2126fd7004860237d0131eac21b4b4eaa3d20f3b95f7df63c9b5a522729277bdbe981dbefa5612b8f41b2f1d03953cb00e0c5f6cf11
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5826ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5826ec.TMP
Size 203B
SHA256 929c069a0e9f4567ffdb720ba0a9bfa62bf2bb799c08c31c2aa247675f3d6186
MD5 b7400edfa840eaf066937b4ef4f036bf
SHA1 43c0ffd3007484ebf941c66615a3e040f8f8afcd
SHA512 84a1729d0a0fe97b8f7ec78d93d50c7112a24a30876dc2d967c690b129289467a6da072c3d3d94a31d908a4971a246f8e4c4a1333adf811786ce17cd4319dfd7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 aa008d4892168e49c0e0b44c4acdfd8d72119d505cd0a71855c874fc85763395
MD5 892985101766cd222431c9debc30c3a3
SHA1 dfba5556c2d9fd885adce3e2ae040f2a513796a5
SHA512 941d58f93be7ccfd5ddb4a467d224549f6be2445e68f7227e4622a12fcebe77a1e87f84671531b31902a13aa80d5cbb23e6bb0ee4ccb47c35bf126d05b0ea9d2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup01e2RU8Rud3z2OMDCRHqln:A9iIxuERzA83h09RZxY0xadaOMWRHqln
MD5 SHA1 SHA512 SSDEEP

Submit Download