5a2f3809b0f1e1ef416fa9890f1590b96869517e746890b8bae994c6a15340c7

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5b670e4f10399888b91a0fbd9fd8cbc_JaffaCakes118.html
Size 30KB
Sample240613-qe7dksthrm
SHA256 5a2f3809b0f1e1ef416fa9890f1590b96869517e746890b8bae994c6a15340c7
MD5 a5b670e4f10399888b91a0fbd9fd8cbc
SHA1 b27ceb450486a39945734060f19d88c7b17f9c4e
SHA512 64886938b97361c5a465299780660f1efa630b8f065bc4aa0ba0ae3b6883768fbc52ff82f3803d8f9819c74fe0e90b04b957797573adee8422f0039db1ca219e
SSDEEP 768:3pajpG6OSSM2lfa8kQfqTLEmhP6bVczcA:5ajuSSM2E8kQ0LEmhiA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1012	msedge.exe
1012	msedge.exe
2152	identity_helper.exe
2152	identity_helper.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe
4076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1352	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1352	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1404	1012	msedge.exe	82
PID 1012 wrote to memory of 1404	1012	msedge.exe	82
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 3928	1012	msedge.exe	83
PID 1012 wrote to memory of 1436	1012	msedge.exe	84
PID 1012 wrote to memory of 1436	1012	msedge.exe	84
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85
PID 1012 wrote to memory of 64	1012	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5b670e4f10399888b91a0fbd9fd8cbc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6b9c46f8,0x7ffa6b9c4708,0x7ffa6b9c4718
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,2490442218423864802,5564198424523615988,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x4b0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
MD5 db9081c34e133c32d02f593df88f047a
SHA1 a0da007c14fd0591091924edc44bee90456700c6
SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
MD5 3a09f853479af373691d131247040276
SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
MD5 SHA1 SHA512

Submit Download

37e9a413-5b26-4dc6-95c7-1e200eeaf74a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\37e9a413-5b26-4dc6-95c7-1e200eeaf74a.tmp
Size 6KB
SHA256 3af41146192c2a73718d4584d69ba10a486c9b13fa985c67da45b6c67daa9aab
MD5 3e05f72c88534366dc6d5fb989d4b782
SHA1 6621252df143f480d6acd69c5a8c5f873775e9ca
SHA512 8c67918af63f368ce3328a7095d8ecc6173188b70ec1f4a9d3d3667d5ecd9bd6c5c848866f00c282b76f12a0b00f22be2b04f3cd9ccebec9ee2f40bd75d8a124
SSDEEP 96:nwMkVoxm/DQYmqAK1hW/wpvWMoiVmdeHgiVMr26UWQyV+VDCziEwb:nwMkfIBK3YGWMXVMr26ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 e600ad810d7219bd0a1f07bb2b91c67d74a5f042f5bb64e9d02daa82d88d4a96
MD5 ab4654904f37fbea916c6e3d7cca6539
SHA1 e02c605f59da223cf0ac2074655af6facae630cd
SHA512 05f2ff203979e84d83564824c2f11093236b87327d337ea59b3619d826944b68e33c3f7a8eaff7f953f0fb43ce2ec38fddef8f3ab5b9e66cf2841c5d8e270805
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 938B
SHA256 f535c3c00f1b1a010e9e7aabebd366c877b41bb04f8e6919d3cf298b4a83f320
MD5 1e0c5f17a991ead620152b6344fdafe2
SHA1 007315d0728e059752598cd95514edc50afc9e24
SHA512 95158aa58586a34f31e6c794534f49836ff2990ff9063cb6d4affaf056d2e53624f43302888e4abcc5e7693bfcda43579e2935c3c0b01f5795f1fceffdd55ed4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 066711c69c7c1a2c894a3243db86439645b24e57641d65aca04a95a183926994
MD5 783eafd131474425745d9dafcdcfb9f4
SHA1 74b96033222ded4487e64a9b1e68cddcf7f5ab49
SHA512 1abf4acd6e11c8f0f022d8465ffb9b5562c86ce4cc6bcae10ba1be252d4c3b0a82e15dabcf06da94f133fc5a77579b9ea3449f8b234b986df7f68d7751a2068e
SSDEEP 192:nwMkf6BKb+GWM2c/RzTFdlxHqFW2VMr26rg:nwMPKbPWHCRxrZ8762T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 105bd0a2cd177d86ad72dcdf7bfe4333d3059ce68d23c1805dfea12e4cee5638
MD5 ccc6d7616311e0d22cfdecc95ddd42e2
SHA1 df034c0c0d284822c633cb57847dd108542eb31e
SHA512 f66f0e56a6e673e126b91014464e32ce15c408ebfa70ea82c4de3f0501a418a3003732c0f6ff20157c069efdbe55ce43bf359961a17b2aa8ded8782069bbd2f7
SSDEEP 96:nwMkVoxm/DnmqAK1hW/wpvWMoiVmde+d2giVMr26UWQyV+VDCAiEwb:nwMkf6BK3YGWMud2VMr26rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 871B
SHA256 50e4b5a5e0e5451a47e724da0b550c30836c1e2025393e0398fe4c1b9e8b466d
MD5 8a67c3c55667ae64b1406b077a85a3f3
SHA1 3917e82851657b2a3ba21084d1233a35fd6174a7
SHA512 9d4275fbe32fc5462b9e5b280531d792b9b5921a465c5c0826e6b6437871f88d5b41851f6ff8fc0772d25025bf2f458bd30454826f2e17270c05059d8893584e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57cee9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cee9.TMP
Size 871B
SHA256 8aeca1c3be7e04bdfc7494432affb40fe721a3fa0e52ad51c73578a9379cfcb2
MD5 5e3aa2abbd8c20d1e8da97ce5be1133f
SHA1 f40182b0940b8b08a4cde7b74b994f050d6f7d5e
SHA512 371ba11d3da72e8acab25eb43ac6e81fba77755181594b579734bee7c1c952670daf2b6ca39c94bc388b230c189acc7defaddb56d63f9b5bf536d564b7d39af9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

d02c0490-576f-4c94-a0f4-da314d43e31f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d02c0490-576f-4c94-a0f4-da314d43e31f.tmp
Size 11KB
SHA256 14df1471f61d1961e5b42632cc1b53216422c9b4344f73e04c292305b0e1f09f
MD5 d4c32b975e5d869b1ebc5b65bb0c889a
SHA1 0c1624022916a43ce87f75fbc78c936c0a76870f
SHA512 02e7c6fe42dd6fa7c83213c0d0f355a3cd0e05edb91d7798db4cb0aa7a54290965446c02db4ecf3891fb04763c61ec680813659091f9da6eaf31a27822b77335
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupsGQe2RUmrH2kRe3z2OMDCD:A9iIxuERzA83h09RZxYsGOjrLReaOMWD
MD5 SHA1 SHA512 SSDEEP

Submit Download