a64dd9c45421045562f3e38eaffe701bde1ed742760b3aca68081772a3bf3873

Analysis

max time kernel
137s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a77b2b8d575e8a6ef6efc7cf51dfbd74_JaffaCakes118.html
Size 69KB
Sample240614-blhlgashpl
SHA256 a64dd9c45421045562f3e38eaffe701bde1ed742760b3aca68081772a3bf3873
MD5 a77b2b8d575e8a6ef6efc7cf51dfbd74
SHA1 444a66ee8d09737822e5372ccebdcdc49124df41
SHA512 d00e929881e0a1a2f397aa50b948e51af6e92b2967b63d38e1ec0dcdc8dde4e442aa6535ffe44caa80648509ab8686b248703b1744d32246d52e8bc9e5f62dba
SSDEEP 1536:sFh+9tuFcYjDz3lELPx0cFEwwwKR4e1ySoCmS8GY8Exio8bKs/GIKE3yiAzUGC2p:b9tuFcYjDz3YxuH/GIKE3yiAzUhPc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
1496	msedge.exe
1496	msedge.exe
380	identity_helper.exe
380	identity_helper.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe
4376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4892	1496	msedge.exe	81
PID 1496 wrote to memory of 4892	1496	msedge.exe	81
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3456	1496	msedge.exe	82
PID 1496 wrote to memory of 3684	1496	msedge.exe	83
PID 1496 wrote to memory of 3684	1496	msedge.exe	83
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84
PID 1496 wrote to memory of 1868	1496	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a77b2b8d575e8a6ef6efc7cf51dfbd74_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd08de46f8,0x7ffd08de4708,0x7ffd08de4718
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1752 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4307311953461739028,7419411215740062530,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 752B
SHA256 7e4fbc8635eed4b50ddb00de626a6e193c46bb77de6cc4b8a9e1c43a5fcedb63
MD5 cf924fdcde47d57f0abf5875036063d7
SHA1 988308a07d0b8af989e4f0effbf4fa1dcf7be76f
SHA512 ab8bc97e5b13f0be601fcb4827172cfb7ba38deb5f31430b3eb09168fcc01b61c68be9cbbd8527af840422dde97ec86f2d056b4c869ace1bab6704ed7ea2d193
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3762e545865e16a42baf897f02bf6b57954c2e5b3cafb8b01babdb3f4a01e7a2
MD5 e98354ada244c86405ed130826c43aea
SHA1 3adeb49cb2885a9b85a14fd3bed088e4b58fadb8
SHA512 80f62c697e6b3b81bc0f13f924d8ecd56fb2ace0e3b3d32720120ca411e17d24441325b0056b4ac8abb458324443049df2e657da775ef255c6085ddd28277bf2
SSDEEP 96:nCkVoxm/DQYmqO1P6wwpvWMoiVmdeHIqQUgzUWQyV+VDCziEwb:nCkfIxYwGWMXdBgzro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c15d0c53b5d06262cc8e67734eb7e0d6ee1c0e5dc0900e2765879f1430b76a72
MD5 dbf2812bafa32d92186b43c34e8e5deb
SHA1 c241a30dd886d481780867940bd9695a2dc095a3
SHA512 de566ca2c22fca14e2ad6b526fc99f9e77669a8829fa3b821d70806f44663cf2d61021bb938c432eec7f95ab0d3b21789546dc2652338dd3e8b0942f36b47976
SSDEEP 96:nCkVoxm/DnmqO1P6wwpvWMoiVmdeaS2IqQUgzUWQyV+VDCAiEwb:nCkf6xYwGWMqS2dBgzrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 28ca8ed426a0f31b01cac6523315239cbd6a86c3699940c046a0949a9ce2af4b
MD5 c76b60e129edba0e14c4c83d1712cdc7
SHA1 6b16c16dc294d4489cd844425a1ff3a734ec35fe
SHA512 1277fbb55dd66c8493b9179d0af8d42e9671530674a8152ec10a6356fe7b1432cfb37bae8ab005326ce4409a09acfe6bcae4771e86152482db3c5cb8c7fcb9e7
SSDEEP 96:nCkVoxm/DamqO1P6wwpvWMoiVmdeaSTX48G2NqIqJvUgzUWQyV+VD7AiEwb:nCkfdxYwGWMqSTX4aqdJMgzrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 1ec3f60254c14496befb25748d21fa1245e9330d58f7812547c6459ba6b6cb84
MD5 6f36d03c02e50f21059fc0e8444adfb0
SHA1 2239e3e756fa22aa5eddfff9e052fcee4a9ecd0a
SHA512 05d40b9cc610634521a6f3a2ceb9bb38b979a59ee0003d456ebc3c85acdd10802e20565b553fc18e167bbd41370daac86a5b6aeeeb1918d9adfa7a74f39e6b88
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 537B
SHA256 facf08cd9cf96d9459bd24e5a3d8c5f3087f9c9262a528181202dcba5e1f3157
MD5 bc9f466a7d70bcdb7da081ebb8cf45b7
SHA1 04bf7b5a0625838639188824284a14725fcdfed5
SHA512 f1d36d66e49df9eaf3146a7511905224786bc184fc9936d7ac0bcd4ed08eb07c5b6152a393add2a668cd750b9bbacaecf0c9bcdec13b5d99fc6acfd11944f9b0
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b277.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b277.TMP
Size 370B
SHA256 5696043f47f54ff3ff788fabd24449fdf27685555ced6980eac965a2a9c1818b
MD5 1cc1e1e1803dcd2a8d73c43f57be19ab
SHA1 27292ca5c667b5a7163134ebf14329f5b4d0097e
SHA512 34826edcdaf5dc1c3b83d3a47234820767b164153989a79a83b93356f2201d5a99c3f46d59969d61b5396963dca011ea7498e5dec79453680da120249cce6707
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 05cf31a5339d0e8e04a5352243a843eb7c38c248dcfa11ad9dfab43ad655fdf8
MD5 0adaaf1ce783f4d1cd4477c022bdbc60
SHA1 b71dc900134698d18ad07879a9b5b4909531e1bf
SHA512 d85a95fd65e234dc27cdd261eb36b7ecdd3ba110e49820935fa7ddbc8460e55dd0a347b7537535b460d9c4054cbc837313ef9cca80df8426aa4efa534a23504b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptp0Ue2RUBhdvP3z2OMDCR5:A9iIxuERzA83h09RZxYIaMDPaOMWRHqC
MD5 SHA1 SHA512 SSDEEP

Submit Download