Analysis
- max time kernel
145s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
04/10/2024, 02:12
Static task
static1
Behavioral task
behavioral1
Sample
1168d5954a086cc28b47b0b690d2fd44_JaffaCakes118.html
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1168d5954a086cc28b47b0b690d2fd44_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 1168d5954a086cc28b47b0b690d2fd44_JaffaCakes118.html
- Size 231KB
- Sample241004-cmvsvsyfpr
- SHA256 e69df5903334a761d8b8d4c8f57eb6e405b604f04c37704ceb6b85d28919fd75
- MD5 1168d5954a086cc28b47b0b690d2fd44
- SHA1 2301bad53eca1390ab8c151c41e0756a124e8928
- SHA512 e7eb603b7da40c9cbc7cf9473a2869b6f8c10e9454cc0df20836dce44321a8b14bc9360694fff6bd5bbc841950287756685a55375ead784fd29e7e939a2c5459
- SSDEEP 6144:A+RELVzhXkA3d8VZQvzwV2lms5JBpknvjXGXgcHjP9cKQ3:jRELVzhXkAN8VZQLfh5JBpknvjXGXgcI
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4888 msedge.exe 4888 msedge.exe 4456 msedge.exe 4456 msedge.exe 1176 msedge.exe 1176 msedge.exe 1176 msedge.exe 1176 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 5040 4456 msedge.exe 82 PID 4456 wrote to memory of 5040 4456 msedge.exe 82 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 1672 4456 msedge.exe 83 PID 4456 wrote to memory of 4888 4456 msedge.exe 84 PID 4456 wrote to memory of 4888 4456 msedge.exe 84 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85 PID 4456 wrote to memory of 4844 4456 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1168d5954a086cc28b47b0b690d2fd44_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbf0b46f8,0x7ffdbf0b4708,0x7ffdbf0b47182⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3406112807604972265,12954771750113305243,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,3406112807604972265,12954771750113305243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,3406112807604972265,12954771750113305243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵PID:4844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3406112807604972265,12954771750113305243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3406112807604972265,12954771750113305243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3406112807604972265,12954771750113305243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:12⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3406112807604972265,12954771750113305243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:12⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3406112807604972265,12954771750113305243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:12⤵PID:924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3406112807604972265,12954771750113305243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3406112807604972265,12954771750113305243,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3064 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1556
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
- MD5 ff63763eedb406987ced076e36ec9acf
- SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
- SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
- MD5 2783c40400a8912a79cfd383da731086
- SHA1 001a131fe399c30973089e18358818090ca81789
- SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
- Size 45KB
- SHA256 c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051
- MD5 ede70f717200a59b4cb831635de913a1
- SHA1 d4d6e893ac192b5df087e924ab3356852f8a7bc0
- SHA512 b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672
- SSDEEP 768:aOX/jdsn7ZRu0lXLWWpFfQVGUF/swJ6olJezvFZ7jQVgoGuGQEPaa1A6X48r:9X/q7uQFcGes06OJQ8Vg5QEa+zXHr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 120B
- SHA256 3b8f9b910435fc18fd1346491d38866d5762ee01d0c1888ec6f94a570ee56ecc
- MD5 21b5453ba1f63efc8a0b3a941be248cd
- SHA1 11937eba0a71cfb15ae9bcaabed84dc59a037392
- SHA512 7001f6e2b482132a45f44a456b532e1414669f7e08b19f6a90ea70c5344014e172ba459218227977ca6b541c655764519f38836d8b452cf05b70459990a51591
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 ce9c456ad04d71304b33b65e13a0c64a5fdd10b97cc25be7bcd78d5ebd302b4f
- MD5 76696268aa27a01991a6528d1cbc9cdf
- SHA1 105987a4df79e9565831c68c06056469c3b09b40
- SHA512 49bbb74d4e27b16dd3ba291a177c087f1c58f457a4e64cb60c96514cf99dec8b002df42e0c62163d809c508385046b51e78ba82d684d586557095bc8dc59cfec
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 192B
- SHA256 19cb98e42f92a6bd1e85c36bfe21338a5be9a6f067b37d5dca8774d23f97f302
- MD5 dc91120d2edfe47a6607dc18899d42b7
- SHA1 415ca531ee6fb77f433ce14db337f57b61ca5a20
- SHA512 dcd84c3462797d31289c430b5af62410f0df10b9e66a163a16945db2fd8cf35b2bb1a58c645e57583c1d7e754df37af92577a67ac8e0ade81a8b3544da8351e3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 2KB
- SHA256 e412c2d2e58e7f799c579e324a87f667c63324f56940dd0c26f09e0d7bb14d2f
- MD5 569e920ee378eab8a402d90f13d043e1
- SHA1 23ed33b816aeedb6304d06a820b2db5af4a29933
- SHA512 277bbf98971d6b79e1960b580fd348443169447794b7d82fc47362fc39e99b7a5585a129b50606ee5b404b8e2c7ebacf9351c7ec852a14ce98c6d03065733b64
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 c547a94c6321afefe858dc272aa344962eed4f29859b2d9f3ace8fc1558871c9
- MD5 99227e7caf53c5ff01f6dd962c65420e
- SHA1 954692ac69937b76284ab1c3dcc3be04d4b1c809
- SHA512 00738f97a7d88395d2a49e942539468ca802069b398c36050a6d85046ba1ec1ac2dd85f422b52f40ebed8e36145e3abb93fc4d592071b6e601580bae827e6338
- SSDEEP 96:nikRTQ14404wpvWMoiVmdeQh7FDq7BdbY+r8GIUqa0zFUUWQyV+VDCAiEwb:nikR82X4GWMgh7FDq7BdbY+r3qVGrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 22121c6f040d4ca3e1e5b5f23dcbaf504bf36d2cad6c9b9c14795888a9fec57f
- MD5 e332a42da13505a11d62c90c990052c2
- SHA1 5bb4a02242352f532078bca150e630bc91640fea
- SHA512 a5e38226483846cf0727e44e00ce125ce9d2d2dc307e47c64c3fbbd84a00e242f057d127f4c7c9fa4f9dd5f0a8ad2421e832bc8a3f9328b3a3dcac4c385b3bcb
- SSDEEP 96:nikRzQ14g04wpvWMoiVmdeHa00UUWQyV+VDCziEwb:nikRc2P4GWMXVtro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 2f258f901702b851673bbf20b122b0566cebb7f87d2852a41b127bde55439404
- MD5 cb8ec8d63b388b5c3a6c642b292e2586
- SHA1 741492b99e8104310507c5cec473958cd1b3616b
- SHA512 b4888b178c726436043ae229fdf668a8cc0cf60dfeacaf97437720fdce6744bc72c9845548c3d305ea058f5d6e8464963d83d3b32b00f85d0f9d65149475f393
- SSDEEP 96:nikRTQ14g04wpvWMoiVmdeG/BdbYr2a00UUWQyV+VDCAiEwb:nikR82P4GWM2/BdbYr2VtrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 370B
- SHA256 83d9644ecf0db0c6ff927c675e8d91e602a6e28e758c07a905f8ed33f3b8eb6a
- MD5 9d10dcefe43a0c61ec6144797515beda
- SHA1 06401514c40d26581523f6554ff26203808e2c28
- SHA512 80e02005b3bb53c4332cd2f363ed31e3c97507f3747248e9223941bf147d8db032522d9aca7c711428981ed4a0c3d1b6dec27d796c4d626ddb358abdebb58850
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
- Size 370B
- SHA256 9d11fd8e812cfd4bb7f1072620f0d957d98fd20fea234cb312812da2beb97b06
- MD5 bdd090b5a5eada153eab1f48a4e593d6
- SHA1 6bf35d7613dc753592f05d514fdf8c618a491d85
- SHA512 5ca2bb52a7010dec4a3b3b354c79b19f8a015696e9a766a9a29e1a5fab48c70d54de6227b5f3ce952b65935c5a07dccb9e1e8ed54b66e76b52fd0f5f361c5be4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586b57.TMP
- Size 203B
- SHA256 9205c25301aaa6b517d67125639d28d203638641430ee5b9df7005a074ed17ff
- MD5 2937b5dd7618e4a0c2c3bfd97cbbe115
- SHA1 e7349ee385478ee40e649ea09dc8dbb5f14a97b3
- SHA512 bbcf61aa121c95b376aab643484bb3cd9257ad3a9b48f175ec538bbefcef84cbd001d9083e1f2e6ded9d415fb0c583101ca6255bd878e1d5ea9065001a24c951
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 66031f87261af53e63fbbbb9ef211633c5ce9035ffec474aee437282de77358a
- MD5 7aede1ad1076213c21b09e8171e509b8
- SHA1 54d44f58cc33d0d7b5b7aec139fa93a3b33a85a8
- SHA512 8788fcd80140d9c7154f1653436e0f591f54915bfbe62ccbb4815bf63fb22d2b7b3dbced8ea79b33264ee08c9f2e7fc39d1bd15eb869042d1336d5bb360a6184
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupk5KWe2RUEq9AKIcM/bo5Zl:A9iIxuERzA83h09RZxYUhjqZxr
- MD5 SHA1 SHA512 SSDEEP