c8dd0ccde79e3b900bab21c1cd6f189c760472ecb7e3a0d0c5b1fecceed7154c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9232ab08fc463d09256fbeae377ee999_JaffaCakes118.html
Size 144KB
Sample240603-sdjx1aac51
SHA256 c8dd0ccde79e3b900bab21c1cd6f189c760472ecb7e3a0d0c5b1fecceed7154c
MD5 9232ab08fc463d09256fbeae377ee999
SHA1 6069883c3794d4b75dbf8216153ecbf66a63f2b1
SHA512 c11d04a4a0e84ee8a0e3d87901954bbc135e80e660784214c06c3121b8d094b48c6f1bfe4bd034a9348eb5c50f06636654e676afb69530a85a6de29ed04910f4
SSDEEP 3072:c7TWA0+vb25RxWKTy5bwyPm7Tfye6JzpM821t8aNkp/cVZBEYgcBn3odYQOd6/qp:y25RxBTymKeJBt8aNkuBd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
1672	msedge.exe
1672	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 228	1672	msedge.exe	83
PID 1672 wrote to memory of 228	1672	msedge.exe	83
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3332	1672	msedge.exe	84
PID 1672 wrote to memory of 3220	1672	msedge.exe	85
PID 1672 wrote to memory of 3220	1672	msedge.exe	85
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86
PID 1672 wrote to memory of 4740	1672	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9232ab08fc463d09256fbeae377ee999_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb649446f8,0x7ffb64944708,0x7ffb64944718
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,17136624931293733423,1975609858458022302,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x504
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

4968e0eb-9792-4c03-99d0-143782a98111.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4968e0eb-9792-4c03-99d0-143782a98111.tmp
Size 8KB
SHA256 2abd3c8f280a44a73a1e5d435a6a033dbc159e0b4b17e9b0ea1c3b38493c98c4
MD5 4515f55939470e90290569eacbefe23f
SHA1 5aed9f097f8bad70b760f3f1234a2f708aeade31
SHA512 8e9776380f2345317c41c4f1c9ab2425986ac9d3b71e3d023e154c5cc1d8605c5a3ef5ea350e023922efa3fe7e49c2bcbae8a0ff2c32f0c3cc4c63bd802f246b
SSDEEP 192:nqkg+SjuGWMSfMiaBMwIN8q7HENjXn21rV:nqt+8/WSU
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 a54f0ec3b9da29adbf2e94b60e986d460dbf28eb1cf93911f7c01ee33c78a0ea
MD5 8094da5f2272e8bdcf5588f4beb21bcd
SHA1 1aa103d2d4f588b9ec9e978578f767b991d01eeb
SHA512 400687e37c847196bc43e708eab63f31a0b9cd9d34d30e79418fc0239fd8580cda6512cbb8a7e8fb8800ab3514be1c115a505652ec68f15617c0b09f5393d2ee
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e6406f334dc8a6400ce9fc07379ee6d345943905585193addffa5832be442acb
MD5 5bdcc5c0df12ad9f02a26cf8ed8b7295
SHA1 61fc4e09a3b0e7c5cc094b29b63b92d6d20051ac
SHA512 a8a391ef7c26ea3a0bc78c5383e78b69a59f8737a8e2c487a3084d9ee59ccea094192724daec9a57bb394a991369d43c29f440928da9f9d796c59c0505350fbc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 bd17f179f38d832d7b3e2bd73b9b8e7345143136c8e4d176d7057b7d2710b688
MD5 a4af9b9c3bc4769aad403dcdb243050a
SHA1 2d4237ee5c979c8712b345d57dedb4b3627cf68d
SHA512 8ed0e4be05cddfdb23140e75df85edbfe520de69906aed50958a7663e9cde19215d871807cf771c1666e8e0909bc14465172793af2fde4f2a9737ef36f790526
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 04849459488f349c96c2ee64d3d6e133bfd4db16aa49a8493c438d282fc3abb5
MD5 02ef7f500a09477707899eafa7cf152a
SHA1 3e47d572361e635231affd656d70484e0963e1ae
SHA512 01c7dc65b1f862c5d4f46170c6dfba2f51baad6d2945f488d0191e457254aa4a2ba0055a208bc60357a7befc2843eb030ea33f59602d1e4753030628ddf02ace
SSDEEP 96:nqkfb1ogjuwpvWMoiVmdeHvSSrKUWQyV+VDCziEwb:nqkj+gjuGWMX4ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3d722cb9b5a4a426d762dd2f529fad4c084a66fe76f169eeaf85213f3331032c
MD5 4fd901d32d65a96c146201c6befbce7b
SHA1 c61c79401feff2006d964a57f8c5ccf56265a6df
SHA512 c2a65ba5519ef010af63cbd1174003abde595af8c4e27dc1e9c1a6e4c29d91c92a0d8e462b87b19fc8bc4b4201d17b0cf3a38e4c574ddeb12fd94d13469d27d1
SSDEEP 96:nqkWb1ogjuwpvWMoiVmdeim4wIjXn2vSSrKUWQyV+VDCAiEwb:nqkg+gjuGWMSm4wIjXn24rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f27d8364a4172f9506b7e0d9747208c4d56dc771de1a4b0b777eb43169b52168
MD5 5ce5f5685a9726225d5e513a1ec36039
SHA1 a236caa9d4dac40fa0e93ff987cb4dd4b00a3c54
SHA512 32c9a0b102187176b9d5c25b29c1675d2eb468afd015b2f5891f283b558b3a22dd2405488a22b9c964c3d28898d95b1942b38fa117bb9197688634894b6c722c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe592f92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe592f92.TMP
Size 203B
SHA256 7700942d176739dbe42672f06d38c0a56e1beb700231b83eaee863f8b8a20d23
MD5 c8799b1d61d7314c71bfc484a103a9e8
SHA1 6554ac9446aaa25ab33b17f6f2621b96b78a673b
SHA512 2163fadf45c4b51132dde8b2611724b84a200e2fb5d24dae8af43571dd15d590b1946bfebc37aaa5fc34505b5e2d54a63f0f1213299ffc96eae9f0334b23438e
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b2423fc638dbc469c222f164c1325dea42b8a06169093a29c8d9c04b0fd5869a
MD5 06d667a2a86ac850fc223099b658b90a
SHA1 2558f3de7f66869c3b136258a5622accfd0616b2
SHA512 7c2fdf84194bc854224375a69eb1a64e437429e5aac0f0cab24141162df7dfa7092acff681bd0626368ae5aeed8996519493b3dfd120de8c55304eb1764bbf7e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup9v6e2RUz4uS3z2OMDCRHqN:A9iIxuERzA83h09RZxY9vU6SaOMWRHqN
MD5 SHA1 SHA512 SSDEEP

Submit Download