4dc28799ea0e156be8eb503f59a5c4e49cef4349f3b3b49f0395e8083eeaf69e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
925341c51275ef836d8bf1c87712bc54_JaffaCakes118.html
Size 27KB
Sample240603-s84kwsce99
SHA256 4dc28799ea0e156be8eb503f59a5c4e49cef4349f3b3b49f0395e8083eeaf69e
MD5 925341c51275ef836d8bf1c87712bc54
SHA1 b8800fa2b0061ff6acd688b9cf5aee1597298e24
SHA512 33437e955aa6b8979a6732d5f06d0324b98b7a79bfaf3f7d03c18cebcdfd0a2024d58824b286ed807323b9ec718d60897ebb85229223fb02a736f82b00cb7f74
SSDEEP 768:iUDQcvO4VJ9eA0QcBdwZ71f6KP3/LEBXW7WOuth5Gk:iaQ+O4VJ9eA0Qc011f6KP3/em7WVth5t
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
1192	msedge.exe
1192	msedge.exe
4952	identity_helper.exe
4952	identity_helper.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2596	1192	msedge.exe	81
PID 1192 wrote to memory of 2596	1192	msedge.exe	81
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 4164	1192	msedge.exe	82
PID 1192 wrote to memory of 2092	1192	msedge.exe	83
PID 1192 wrote to memory of 2092	1192	msedge.exe	83
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84
PID 1192 wrote to memory of 3900	1192	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\925341c51275ef836d8bf1c87712bc54_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd521f46f8,0x7ffd521f4708,0x7ffd521f4718
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,11474681332055195078,12989345940928302605,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 715B
SHA256 54424eb7e3c82b51b43fef77737101ebb7dc0fcdfe321ecda83609ebf6647d03
MD5 e4995300bd6d8a9004740b839f1534f1
SHA1 f46a864e71c3c3662a6fe0f406de09299c495ed7
SHA512 091aac28e8ed419704b868514030a5d7a7667ffaede1bb522a0ddc2cc36985e055a95d00e6d3385f545206481a57ffa5d9c8ec595cdce83517938ebc4d2596f4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 be2bf1c0768a65c1f958d0d830a2860d611a561dffa150409255981d18cc503e
MD5 1944d4d2889792221b1fb597e16fd54b
SHA1 978725e6b9e7599f41def50b721e22868aee594a
SHA512 85a8bf97502cf9b53c8d9f2f964782f01d1814f8deb83d617ba25314b13a0d4931da6183554cda62e28b5025b73aedf3d909e1c0968c2b1f62d173b4dc274ecb
SSDEEP 96:nYkmh1ntT3wpvWMoiVmdeHplwtRaccmUWQyV+VDCziEwb:nYkS1trGWMXpQXZro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4d179eea5ee079507375af041216e035c0418862668a8afb8861067829257f73
MD5 1756e70886e1e4143c414cb236c94639
SHA1 5fcde8847572cd70c44b4bcd0a8a4dc2ad87abb7
SHA512 0e8febcd1e4a567e72635ee86c83bd7d9ec3e79e6ae29557719758479ac6e4ce05ac1f7a19c440c6f7130914d233947b5da6a352fe174cbe792f6d23591f6e48
SSDEEP 96:nYk9h1ntT3wpvWMoiVmdeHplwtRaccmUWQyV+VDCAiEwb:nYk31trGWMXpQXZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 824a1e3c808808698afbc4eeb52008766bce1002005045f1f467d3d56ae45b94
MD5 aa8d3c167dac35d0879501568d080aec
SHA1 88aa2b3ec7790c5f1283b27dabc895f9140ef0ac
SHA512 259962847d9fdeb2822a0acc7311cacb45787346777d4862b8e74578c8f12ee406d42eac21bd13ae37f516e8c8e3607798cec3c3d26c61a64ba477d4015c2710
SSDEEP 96:nYkYh1ntN3wpvWMoiVmdejGkqplwtRaccmUWQyV+VD7AiEwb:nYkU1tZGWMPqpQXZrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 13292a1e05a21cfba5c6dac9f24a12c6006a275bd35b78ca3661e555cc18aac3
MD5 86e9f8c90308bdcc405d35bafed60aa6
SHA1 4417e2f9757516be19ab543c02d3bb79617ffe1c
SHA512 1302806c19fb0d76fc636ecb2caad5700af7f99138e657036aff92d58914a013a3dda6a825c1a04454363fe7b3de1e3bf07a6ad0ad53e0df3a23ea381046b156
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 204B
SHA256 91f6108fe814eb860b0bde99c7f0b1d35dfb075d3d003b7134f4a89a33e854ef
MD5 6f72ff486849e0702f0617fdb0a2c8a8
SHA1 bbd1f7560ff6c7fac99360ac6cec88cffbfb507d
SHA512 a9d669d45e9e1063996c00c967abfe75850d24b95e0cac1d4ed5f239d0e028e3654f5e731f796e4fccf50b26e3cf64e6442be55d24a3da83e3dfca6b8581f553
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 095f257d44e44a512a068918450066a0f85e1cd0d03c49c3d9b827ec4ecbd12a
MD5 c3dfef502d4c8a7750184f259a2db51e
SHA1 dd873259120ccd502997667a44759b398161d7dd
SHA512 a73eab0ab220b67416ed3add2677f4c4eb582ac90b1de42dfe1c255bf18340fa1f4b62bbc07a92bb0e8ad8465ff41002af8d0879158c80cb8d2d8e5879ff48d6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fb7bd10e8bcd7328accd30d13c945cb923642a1ec36925f38fcc2c7a94128ae0
MD5 c762609a7e53dc16db6215716136a2da
SHA1 14255808c6472d5e7f38ad6917f664c4eb35a014
SHA512 d1e0c48bd8c58a96b5e2346372868f97a783be283bd0eda82d488bfd36fdf6bb7e687c44c7989475838465f1858989e80015cbd38dc3975f84649eceeb71be1e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSae2RUwx2ZX3z2OMDCRHqF:A9iIxuERzA83h09RZxYzF4XaOMWRHqlf
MD5 SHA1 SHA512 SSDEEP

Submit Download