3c0969830b3c8bea7eccd0288c678880abbf4f7ede9c79bc68a104fe4d7317a1

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3dd807b4a4014b935f07184eadc8c2c_JaffaCakes118.html
Size 277KB
Sample240613-fech4avcnf
SHA256 3c0969830b3c8bea7eccd0288c678880abbf4f7ede9c79bc68a104fe4d7317a1
MD5 a3dd807b4a4014b935f07184eadc8c2c
SHA1 9bb52e284702929b283155020d9692ed840b751c
SHA512 fcc1ac486cc0533c171989e5d2a54baf9775db6be34ea4ad806922a90e394945ee10a9791d4317510f47b0722efdfbb5b8d9a5ce08b99a9e6c5963f1d311be9f
SSDEEP 3072:VbrafmdLlo1pJoqadatqbXtuLkgYGyrQlc7Svd+vZwlwTetr5A:VbrafkLlo1pJoqa/wybsl4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
4996	msedge.exe
4996	msedge.exe
3764	identity_helper.exe
3764	identity_helper.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 220	4996	msedge.exe	82
PID 4996 wrote to memory of 220	4996	msedge.exe	82
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 1548	4996	msedge.exe	84
PID 4996 wrote to memory of 2452	4996	msedge.exe	85
PID 4996 wrote to memory of 2452	4996	msedge.exe	85
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86
PID 4996 wrote to memory of 4800	4996	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3dd807b4a4014b935f07184eadc8c2c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d79046f8,0x7ff8d7904708,0x7ff8d7904718
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9156998876516708158,9489241095882625463,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 87b2daa23b9e8982aa751eb504e059d47c7bfda6e3bca781b5f481d18c05574c
MD5 f463657b8f0c0263e8d1f47e5cae23bc
SHA1 e36122d8de867aac7527cb33fea35e5508d52714
SHA512 e5ac5e20bc74f31be549b59243a89fdb768bb918100587fc089592baaa7dbc5222affcced4ce48a50cab01d69e9ae93c6a086b74fc80981ba22a7b7075558660
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 7490c2e850ed16a9d09f4e4a53dbb0cec082733196ada00a25ac70a31613eea0
MD5 93ff062dbf8fd434ba34e7d90601eca0
SHA1 91b3d606e949fbaf32badbb226d2448ee0b04ce6
SHA512 9c7bd9f5a0ebaf6adba7d5e28bcbe0dbe9773cb14429dca8e482a7790c54166075e2ac76a0518a88c0200934cc6d7f67c400ec3bb959c5166e1e0beb54bfefb5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 868B
SHA256 059c51f60a917174cad92d83aaffc8ca03a4e5f785cbfa9a6e2a520263be4f6b
MD5 b08296e99bd9e3ff9629a427f1f0bb1a
SHA1 afe4990724d8c4f5790664ed0804d818fbd414b3
SHA512 604d2c4a77b54c2d6716fa8ec3da42b5e5becc58743411493e2f59ca3aff2ef9351f6124a0149c6a264d6a1784259a03ea73ff3127923d9c36e483f247559612
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0d7b30bc8a35317a459bfad695f9ce810a8176476e016fde4dc066088c6facfa
MD5 1df4e5c9562c2b1503ebccebab9affa3
SHA1 409b1f330b01e8e01964243d36afd4cc9ced1d74
SHA512 f42b6204b5a353adfb3c3dadc1d099d35aa73a980074a3966707649ba136ac56494a3e2c81a9d8cc1a39259f20101b7f1915e6f27b7f29fbb0374cf1361fd7f5
SSDEEP 96:nzkBoxm/Damq/41vUeEcwpvWMoiVmdevAqVCJh2ni9mUWQyV+VD7AiEwb:nzkrdrJUebGWMfAaCn2Amrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8469a331cc64e5c37bf5059fb14eccc1c2a06691ce7c5ccedf7c79c560c311a4
MD5 cb97603284a0339dff88f6e6c09e3e64
SHA1 b5d65f4f6da7d0ee28c670a855832978093913df
SHA512 5eaff5f98875c7f3a856ddf00760832a3cb3f115d09bb030e107ebe2cd8950f61f2282eba0590c86148eb4c5f27f6359ed0aaf20482b6a3eb4ab96300f6ed819
SSDEEP 96:nzkBoxm/DQYmq/41vUeEcwpvWMoiVmdeHna9mUWQyV+VDCziEwb:nzkrIrJUebGWMXImro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6d47a1140e079811fac96a23586126fc8e5298e0e0195281ebc1a6d5f98e1359
MD5 334f7a1be278fea97d56e9c24dce3e42
SHA1 9f17bbb62886604030e7c5946e549c26436e92d2
SHA512 8fbe2f6ba0564430a86abd7651e4ad8c00d110612dde3830e5df4f7960377ea7a32d79c032a7d7e7c873c95b864bb7083bfe8bd3f78b5f656e2e7f5b75ea6df6
SSDEEP 96:nzkBoxm/Dnmq/41vUeEcwpvWMoiVmdev+VJh2na9mUWQyV+VDCAiEwb:nzkr6rJUebGWMfmn2ImrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 a3a01bbeaeaae0f4bd61f96ad4cbd79b5c5d1ffac78902227bc94c290a44311e
MD5 333491abbdd451de2a44022b3f46571a
SHA1 f07c2111d52eda888253d92484c53a2e1b574d50
SHA512 f707fd7daba6549bea9df68d38ea1c366521305921ef0669258b671aeb1dd02b063b0089f8a20b6c23a86b270de06558f1ca92ab32d6d9285296f26190b50896
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 6569fe078e37fd5188c2227fb76f4eeb51102d915d5e37415f605a946383ec59
MD5 4af3aad9414cd7722b9a16f9c85abee2
SHA1 d5625b2fa714a7f1cb195c5806b436b6ca6c3337
SHA512 eeea0ef7ac176901318216fc205cee2c77357493b29e7c144581f0d6377d37c8cc6a4229526764f760c668440bac1b0f29deab69337cb1315e60b833a27619b0
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57dab0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dab0.TMP
Size 203B
SHA256 f106397af0527a91d36ecec0776e3af3e4d4a08e4111714ac9239b5fad247d02
MD5 48c6eafc4e501460229a8ce3a9fcc8c5
SHA1 e656baec8cb1f784dbc28909578ca523894ae359
SHA512 b675c74ae930532384329ca0b87f204f2a4efcd6559ae283abf8af412d0f6af416653050593613b6620bdae93a68fa8353d8a703e350219612199249fa8cf6f5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1605b3ebd17dd59041b78961c2ccb822f510691b2faec9b605e34f534a5e9525
MD5 4b67199cc51f3048fca01a09a82873e5
SHA1 fc965e9cbae0fee9385a2e56363cd62f139d4833
SHA512 18574f77dbdabdd8ea477b0e19c34dcb3b1461f9d53854afd5902a1ee6f48584c8f503990cb353c1019891cc84daa78053fffa078c2cb2dfec8c7fb205f6bd9b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPSbe2RUe9tP3z2OMDCRHqX:A9iIxuERzA83h09RZxYaLzPaOMWRHqlp
MD5 SHA1 SHA512 SSDEEP

Submit Download