4802ba8a5b3a3ab822da027c96606b029247e87f8d675e7dae9f64351e6f946c

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65c4e771b48a35820b436f8436a080af_JaffaCakes118.exe
Size

79KB
MD5

65c4e771b48a35820b436f8436a080af
SHA1

006447478f75aed22349888089c924f52ea404c9
SHA256

4802ba8a5b3a3ab822da027c96606b029247e87f8d675e7dae9f64351e6f946c
SHA512

a8e858fc92d292ef6e5913710a457aa080f795dc7ab9544bc6cfa4728533a40f4b9f32858140f329a0f341b989433ba4586916b9c2353b171be7dbfaf1d7c270
SSDEEP

1536:8ppv5CNE2E/n/fn8lvOvNOH4KJJ6CHgReeLCAFz49wughJ5:8ppv5CNEhf8FH4KJJ62ueuCAFvL5

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4196	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
4196	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000800000002342d-3.dat	nsis_installer_1
behavioral2/files/0x000800000002342d-3.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
4832	identity_helper.exe
4832	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4196	868	65c4e771b48a35820b436f8436a080af_JaffaCakes118.exe	84
PID 868 wrote to memory of 4196	868	65c4e771b48a35820b436f8436a080af_JaffaCakes118.exe	84
PID 868 wrote to memory of 4196	868	65c4e771b48a35820b436f8436a080af_JaffaCakes118.exe	84
PID 4196 wrote to memory of 3240	4196	Au_.exe	95
PID 4196 wrote to memory of 3240	4196	Au_.exe	95
PID 3240 wrote to memory of 3332	3240	msedge.exe	96
PID 3240 wrote to memory of 3332	3240	msedge.exe	96
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 924	3240	msedge.exe	97
PID 3240 wrote to memory of 1088	3240	msedge.exe	98
PID 3240 wrote to memory of 1088	3240	msedge.exe	98
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99
PID 3240 wrote to memory of 5080	3240	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\65c4e771b48a35820b436f8436a080af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65c4e771b48a35820b436f8436a080af_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youxi500.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb7bc46f8,0x7ffcb7bc4708,0x7ffcb7bc4718
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13273844571833827295,1008139180901878346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
      4⤵
      PID:1668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
60ead4145eb78b972baf6c6270ae6d72

SHA1
e71f4507bea5b518d9ee9fb2d523c5a11adea842

SHA256
b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7

SHA512
8cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f9d180c0bcf71b48e7bc8302f85c28f

SHA1
ade94a8e51c446383dc0a45edf5aad5fa20edf3c

SHA256
a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc

SHA512
282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
804bcb50c84132e61e212b03bba18934

SHA1
6202548644e146c8e7f12d7c5ff9ffb0b3e9db8b

SHA256
8efee8f6aa6942e4afa6dbed4f7573c4ae4cae434e8586023d21c1d64c710b1c

SHA512
8f13ab4fe4491d7f4870df3d47fb3935ee03b03decb0264976ff2123650ebb285eef47f9303f94024b386501800b083b33649cd0df79a16c767ff7dd3778b6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
467B

MD5
bb33ad0db4fea6b2acd37e6f2f9abcc1

SHA1
1075f322e3a00d03a22d2bbc3d39c6ebbeb87597

SHA256
7b2132489498f1bf11436bea6a2087cdf37a16fbfd810c63e59a979ec43daf3e

SHA512
784b43d27a0b6053117c3ca77b1399854be53f55f020fe108cb89bb03d84f2f048f07cb996fa39237566d66f0b8c31b900ac70240c0ca1819e6c8af7f13cac2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53935d5a4670e73866d520bdc3af0f61

SHA1
ecabcd89fa167a54a8a5212758af6df4891aa2b5

SHA256
23d7360c5a9092e35504bc7a7df69fb170764e13ff79c55a80d4993e566dfe86

SHA512
684850e81b5ae15ce74a78e223f9239192b0cc4e33e20d280ef678bacfdacfd2bba5e221719712a96bb4e57aedefd6a1bf5d0d8fd4abfa47b9e87dab28a7f75d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e75f57e74af81530b5af7215611d578

SHA1
49ecac49f5ed75e0fef81fa316100c505c762b73

SHA256
914a4f46fc0348a313e52a53800171b91cce8f5f01fe71d232a1a1478bbf0210

SHA512
00d4ed880579739066b5d9bfb8fb781cec0b89467adfb6e6f9b4f7f26e625398fec54d03eab4c4f4da911ae3abbc1023702ff60a176586c9313d3098610aa590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37bd2fe59623f4555113dfb81f50e762

SHA1
d6b98b4436eaf4aaf7b3a861e4b0f3489c158ede

SHA256
c50081072808a882dad860cf26f6d67889d93e96fb930353a9161f911347d806

SHA512
3799ba5a4ac851c91d3f175c357e6f5ee344d800142823bb3bd743fb4d169b12891b101926123b708da402f165242d3ee2caf23a2907972975e76b3119450c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
077fd00a3dd645e2d21e50be58ffeb21

SHA1
bd6ffe5a2b8a103912fbd61ee5e1eb6c2bf79810

SHA256
509818b5ced1caca978468987a3349c4e9124cb747197eefb66f0f64f78e28c1

SHA512
249dde3520939beb76aab8d422bbb7b9e86c8c971151c7a6a2ae24786b161a00f72c27650dd5630e466f3f27d7c82dd08daf6a9b8097752a11b3fa8b01764695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
9c1f6f379f3d42a3d06db18a3b0a4dcb

SHA1
cd78f11079d17c17ae1c1067b5257cd97e99bda6

SHA256
8bd70c9dd389b091351d670bfc9d06337d357cff96bdec7a56b4fc214eda203e

SHA512
bf62f764552f216164a6d9785125280fdf118c50e4e3549a7d7666402b6e872403fa198ecbcd8e485722e7e939aa4b2096cc64869fb37e77fe2babd0e9ee0411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
7972a800738120529a29b00688106d8e

SHA1
beaee0d39e07ff6bd213d0ce4e503c2420cdb68d

SHA256
f24abcc233fb1461f6c60363dc1671e8a3089a44e0aaffee1bc0f871507bfdce

SHA512
3f8fb90f8f9d12c477110664bfa6b2dbce020f156dd39cd4fbf9a76114d08efb1d1b852a022c8bb4294421833d062e626eda6633cccc58a5ed344314c1149e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583004.TMP

Filesize
204B

MD5
c88a9761b946d374a93eb4c9e85410eb

SHA1
d34e366eb1431c64866d51b68ec33979324bb4df

SHA256
93c15702a8d1ed3d5b742ceae7a0309374f714581ebd4b6850c5f79ca94a2034

SHA512
3fd316b7467f40c7a33291eb888681c3da7af5f58c25af1b22cbcf2da6da87ec88e28a40bf390492dcc06db1b22eaba841042655ae59efc46f26b48446a4cfb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a9bd51ac5da80b328dde5ede4688fbda

SHA1
de18c7c0a946f1904812334a273f3a2727290c0f

SHA256
fad56f05c8adf9a851820a7df1041899673114f40c65625ed47ddd3f0ba7a0b4

SHA512
84b3fe843ab507ea51fe486cc8ea96291ec762f9a3f2143185af1344dbe0d5c6ac280093750c86276edb6b23644d7aa27e5475f00630b051eabefa2aee519b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
79KB

MD5
65c4e771b48a35820b436f8436a080af

SHA1
006447478f75aed22349888089c924f52ea404c9

SHA256
4802ba8a5b3a3ab822da027c96606b029247e87f8d675e7dae9f64351e6f946c

SHA512
a8e858fc92d292ef6e5913710a457aa080f795dc7ab9544bc6cfa4728533a40f4b9f32858140f329a0f341b989433ba4586916b9c2353b171be7dbfaf1d7c270

Download Submit