0225441639f46ecd36805d6ac27df0528fa6421ee7e881f6c5468f0f6a37e5b7

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd66def3bf88b28c28128b1b601b4ca3_JaffaCakes118.html
Size 121KB
Sample240831-xlsbkazdmk
SHA256 0225441639f46ecd36805d6ac27df0528fa6421ee7e881f6c5468f0f6a37e5b7
MD5 cd66def3bf88b28c28128b1b601b4ca3
SHA1 3f4ad2c549c7bb7c24275cd6ed4a9cb1bf70c3da
SHA512 5a0aeac4341895126671d4b3e5ff0b38d0149d4f360e1bd1a9c001fab0a8588e474461f8578cb98f6943f8ba8523d8d6beec3c346ffcae2eca5956c27e9d360b
SSDEEP 3072:pUdCWDxYxQ2PDxYxC2T/Z1sfoEZNRdNSefhENE/jzCqezq13dO:pUd1DxYxQ2PDxYxC2T/ZwtM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
5096	msedge.exe
5096	msedge.exe
2044	identity_helper.exe
2044	identity_helper.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 2580	5096	msedge.exe	85
PID 5096 wrote to memory of 2580	5096	msedge.exe	85
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 4768	5096	msedge.exe	86
PID 5096 wrote to memory of 1308	5096	msedge.exe	87
PID 5096 wrote to memory of 1308	5096	msedge.exe	87
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88
PID 5096 wrote to memory of 1612	5096	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cd66def3bf88b28c28128b1b601b4ca3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83fde46f8,0x7ff83fde4708,0x7ff83fde4718
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12920348406199520276,5167768127328224505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 d044dbaaa9e1ddde41971cd4885d31832904af4b4edf0bdc2d34f262c20c8a0f
MD5 197140b8e170b4ff9b6ca4c68d59ad47
SHA1 a5afc8252bb9bbf2630b169c14cadd4c5691711f
SHA512 4ae4730aaf76cb805f59eb6bc3563fe2792399052830a689b2beebf7a620e7e0a09ccf856db2da9b04ddd7ab8d7e2b962ec4478c6f1bfd5ec279528204fc2901
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b59a636693075cba875539e8120a5b8782e81f5003791c7b9df41b692f220df7
MD5 e496bfc723611b1fdcd8a19696b724e5
SHA1 97edd18cbd2fb9f43dcbc43cfd7839d2a1075985
SHA512 8adf00eac4d1d4ec7f1fea1a314502610e0a47e50ccaae02a1eed0a154ea33effaaac2529298acf85d811fa95edfc62cac17e6de3ca84d6ad07e950ab861b00c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 abc24ce2b2a0f53eb20c98ef50d19b7a3a8e2480f4ebec97c819c05b35a31f78
MD5 d650ab82c2005253a7bb5a927697fbe4
SHA1 cb1c25f8513a15e26561044c7e25e6619f78642d
SHA512 bca104399a96b12fdb824140f89637a1b17b55e107dac334f7c54a49574ebc047be033c2265d5de8dd0bf7cc2ba5d7cf11b5ddbe633b1c9a6b92e16c3b1b2f83
SSDEEP 96:nvk9am1RPKLOrwpvWMoiVmdeH4s5GUWQyV+VDCziEwb:nvk99PSGGWMXGro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 25d4899b07f0b026817787b0d2c72ba50d7dd23a015e27dcf91dd04e1d1565a3
MD5 94443c292d0fa9b1b75cd06babcab0b2
SHA1 f89d050cb646fcfc856222efb54d3ac0559d32f5
SHA512 ff292d37c886261f6649d9459eac52ac6b0262524fcec25bd01a83b51ea716d481ba403d52fa9141ff50e190d30309c093f72bb4d2287f90b47d37f45fec23e1
SSDEEP 96:nvk9Em1RPKJOrwpvWMoiVmde8DeKG+VcKYLWnrFK224s5GUWQyV+VDCAiEwb:nvk9bPSIGWMMDPV2KYLWrFK22GrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 f5939f797253956b8dc8a4f911e22fc4c506ab03bf4e7b6df34c9dca7f2221bd
MD5 a9d0d48437d5751df316b117cd812e22
SHA1 500d923f50c03ea14595bd69cd95cdce14ad2bb6
SHA512 08fa6bc080d433a7b6294b4d817af61fff3432a7bbfb51c65f36e2ff61da8589c5a980ebfe902487a98a0d3c12a334560643c77dd2fba7274ec941c0c7c7ad57
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe583767.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583767.TMP
Size 203B
SHA256 fb887a602ffb77518e9c45d9bf0c99b4625286c18cb72674c243701a1c757c2e
MD5 b33cc2ec931c2aae1f6605d8fb7fe0c9
SHA1 76c412d3e9417a4968e770711f14c316c23348c5
SHA512 124728c225875769e1d7637733bb59db0c17d3ec86e23dbc348525beec9d6d9049c3199c63db237e646a01577d6408bae9bbf1ef506e175db7e346bc903e9be7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fe690aed728a94227807251a0682ee0592848f7bf910ec8852aa2ce651b24778
MD5 4a67aa344e64c3bad5a775a6534c1754
SHA1 029887ed3e1c0d25d66237c6993268971f2f406a
SHA512 a278541ff2518484ec1b3ee7737dc44ab49cfd231834b4032a240d84f3466a2144fe4f001af20050f121581930e682e6da7a89b5f2b082a50bb95fa65f5b5ae7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupbe2RUJi6cRw5Ytj9Zklqs9:A9iIxuERzA83h09RZxYLO3kLskyj
MD5 SHA1 SHA512 SSDEEP

Submit Download