6178dc55ad9f052e7e8f0199050519941330a3e2037aa06ca0d1ef098fbf02f2

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2024, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e1bda025440047feb687204a9534385_JaffaCakes118.html
Size 151KB
Sample241030-glt76aypgm
SHA256 6178dc55ad9f052e7e8f0199050519941330a3e2037aa06ca0d1ef098fbf02f2
MD5 7e1bda025440047feb687204a9534385
SHA1 0c97338594682c7eddb021d5bdbcd9d86dabeafc
SHA512 956dad9e4cb31c83c51287162d78357b94953ec0eef394fc5f6193eaef88c5e53018cc37dd5cdeccab31398e7f57a5dc37206e87a0bc8d67673174bba3179702
SSDEEP 1536:hmJEEJXFRi/gDevYCjanDD9BVZfkjnJKlf5wrw+iW:hEJXri/cOYCjanfVZfcT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe
3812	msedge.exe
3812	msedge.exe
3204	identity_helper.exe
3204	identity_helper.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 5116	3812	msedge.exe	84
PID 3812 wrote to memory of 5116	3812	msedge.exe	84
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 4388	3812	msedge.exe	85
PID 3812 wrote to memory of 1428	3812	msedge.exe	86
PID 3812 wrote to memory of 1428	3812	msedge.exe	86
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87
PID 3812 wrote to memory of 5088	3812	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7e1bda025440047feb687204a9534385_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff9108946f8,0x7ff910894708,0x7ff910894718
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,13715236794304127339,3549307470012731524,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 389fbe9015e11d1a637b045adc2aadf2ef2ecc7003f387173c6ee2d9ecaebfac
MD5 cb47a91491706701f73b7f8df4972cfb
SHA1 23644021501bcf019d25d362b9e8fce78b0043b9
SHA512 fca05b1fa0072b9bdb9622e86cf3d27770d127f1788ac17f4f26dd3e380a1ce69c7a6ef3d92e4d5bbc1c6b7462dc23822785c561fac031a07d2c372bf3aadfcb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 4a6133db8a286b6ce837a266fe09f725261f34e2952c258384602ea7bcb4283c
MD5 517f015a82c839943ed61e7f90547fda
SHA1 9a33bf820ebb499a8f4428a2c910fe57be02e8ce
SHA512 b32117b3a6b8c0b01f0d60a612480c2b040efdb1d65310e6f161576a7424688854677dafb532361b9e237d1db156bc6bfbed52fd49183e618a821c9d4653febb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 921f0755d9899aa78e0b43df6578a1193a32b30f2e65a4d8a1bade689ed96974
MD5 8d341e6f739f5173a05561c0a71d610f
SHA1 2fc929433dc0a95ee2e980a525f12730e634fbfb
SHA512 519e2f1fc3c952b592a32856b8c87d0c5ccf9e9bb15c62fb06ffbcc3ad9955a914374cc8cb0aabde95fa115cb9efddc2d9a2da062064e126dbbaf388d5db75e1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5ebf7a2431238ca406aa6e7529a083eadeb183205dd44b4e468ebe464e1f55f8
MD5 5afb88df6cbd0e89e8c9cf8aff79a561
SHA1 795d77b4bc72712eb08d47ed2e94aea0c9d0ade3
SHA512 23eff3d5a5be7f44264567b515cbf9298e95a109cd8341b96d8b54f192f66b8ff2738924c201f9b68f2f9a635b881ed74a2f009b2537e7ca235501e44278ffe6
SSDEEP 96:nMkimi1qHiSwpvWMoiVmdeNeiN7ViZxm2BjszUWQyV+VDCAiEwb:nMkniQZGWM9eiN7IZxm2BOrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 6a252a658691db5515249c1ad98006c991caf53933e9c9f12c9cc1e4bb3525ad
MD5 b5fc5a435c38ae9eeb457b26d66bd234
SHA1 cf11158d6acc8d14b88769add1e264f403aec6ef
SHA512 53db90af1c05712b3d17964e8d4bbec7d7c3dbfd12d8984bf3c9f8b3d412e738e2db7968017be4273a8f124d0034a1af9d880431a1a7480d1e7299577a15ced1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581018.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581018.TMP
Size 874B
SHA256 fc3b88e3316218a15be2671fab4efe832d353c6a33494c9740d2f4be5e426674
MD5 ee0189615b9883792910af216ab51424
SHA1 6053d2aee2b3f719358055ac44f945f468f09ba6
SHA512 c95e3353d2e3c298c964b6369188b42a95f2fcbeea46642d284d897494554e0532ab54d7a079c0175b0d6e79d257a8863ac30a85f9b780fcef973e40cb0deac5
MD5 SHA1 SHA512

Submit Download

d090f51b-58ed-4230-89c5-e57d180d7b87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d090f51b-58ed-4230-89c5-e57d180d7b87.tmp
Size 5KB
SHA256 55590c56cda13dae2f19c9435f5bbcd72edea325d8f8629e9eb9294fc33b0af2
MD5 95ca2d12b3a3b91ec673f7e92a9db9ce
SHA1 91ad574db0861bc23396cc1797b96c3502000de4
SHA512 590d0053b2183520c94a14491d936be48adc07dbf6e027491868a6bc488e03545b439e22b6db5ce1d3a043f91141e81bcb9b43dde411eca9c0c4c58a38e559bd
SSDEEP 96:nMkQmi1qHiSwpvWMoiVmdeHBjszUWQyV+VDCziEwb:nMkBiQZGWMXBOro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 148a7998c42c31cd22db7e30639973de62d4ca50b67534bd726e68ce97617744
MD5 c562f72fb540dbc830d9a2da25b1faa5
SHA1 2e46bac842c6469983edaa013c898a64a2a8c446
SHA512 781f304e328757492b8d4668b35db8cdc1a824e9c561bb16a530d47b8ccc549a4a30a763db72eadfc967dbe45e440cc24964df79ac63a10e12cf7f21a5cc01e7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKe2RUV/hhRHqRUx3GPOx9b:A9iIxuERzA83h09RZxYEM30SFGmx8on5
MD5 SHA1 SHA512 SSDEEP

Submit Download