beda24749dce6dad217043f350cc0291f2bae81e7ba098298dcd4176dd5c1ae5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
915ffa95f257386286cca3d9a5138489_JaffaCakes118.html
Size 95KB
Sample240603-l3a8tsca75
SHA256 beda24749dce6dad217043f350cc0291f2bae81e7ba098298dcd4176dd5c1ae5
MD5 915ffa95f257386286cca3d9a5138489
SHA1 19c15e05b3450eea04164b9457b39b29bc6d4024
SHA512 660808659a1c983058724da1d7de99d42677f119edd370dc96f83a7e1b8cb8e9a08590bc737c78fd87bd392dc8525d041456c11fe2f6441a77b25fb46b9b80a3
SSDEEP 1536:6E8qV+sLIvI7l26YMCnVDE1StQsU8BYa00kFh9gmJDuwJETZJ/rz/JcVT/rzOcQJ:v+sLIvI7l26YMCnVDIStQsU8BYa00kt4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2796	msedge.exe
2796	msedge.exe
4016	identity_helper.exe
4016	identity_helper.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 4628	2796	msedge.exe	82
PID 2796 wrote to memory of 4628	2796	msedge.exe	82
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 4404	2796	msedge.exe	83
PID 2796 wrote to memory of 2656	2796	msedge.exe	84
PID 2796 wrote to memory of 2656	2796	msedge.exe	84
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85
PID 2796 wrote to memory of 656	2796	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\915ffa95f257386286cca3d9a5138489_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a4718
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1124 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11984600914873753241,5655640666369962831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 258e2460fd7fe6ac3e1e9967b1b92485649bf64f1168571d81c0b12c375bd92a
MD5 a07309af6cef298949ba0d67a0150ca2
SHA1 88bda5f844863e1314a34c7f905cec596d3ad01a
SHA512 689b8996de9988b232dc363cba1bd05d0218818c7bcb95224c3c456bcf7a75275d02070e213b1d81873dd9f6017a72e6d775e4149fb0fc8ea26d2a748f6222d5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 309B
SHA256 e6ae8d2e2eeb1e7f59cdcd9d23594e9939dd0d0e2bd658b083a68a931a0c8eb1
MD5 1082cc143659878b0a0c3388db902dde
SHA1 44a35b6d5fb2e6359f9463448bc125ded766914c
SHA512 3161abaf1738666cd66e9df613876adbf8a84fe28d7768589f8736b5f23ee6da59cde3ca66c90cb0e3348c48cbf4290d5049c3706c12d33131c23c229702ded0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 309B
SHA256 8028140ce9976215fbddd659c06fc10edf99779776ae9cf7265474279929ff81
MD5 7b35c14a8dd7721dfaaa824c9c91c4e4
SHA1 7570e3ba10ed64b7d7266671d75c99fcd66664a4
SHA512 4f315bdcfc0c0479d854e2ffd11ebc8635c045af6092c8c668fa8e8f23dbf506e7cbd5cdd342a705edcd5eb6ca4a08facdcd8ba3f0b3b101d17242422f2775c4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 9f737e7461725d192a52c259079a578d8f992cdd31b2e2ccd81e816931417ad8
MD5 4c7db2845284612740b54d877ecf8102
SHA1 49c60e5de0498993076ffdb73bda0cd9184df6bb
SHA512 075c036465ec7d7378cf8f69053dbcad70a4e9028f4c35ab2f2f76d1045e13e5f7bf5927c64c3abd6075527b9d46714a95649df80053b32dd43691d4d83de4a0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 de231423e785dbeb9efd2d056a0a97b291fde794419d3a0ce9eac3f6508a0da1
MD5 c4216cf65b2a62c0f183f7e4fa23eed0
SHA1 a23727e44db11b2708b8dc90414d55f4c63ef590
SHA512 3eb0862e55a15b57a3e0f2315c3910866dd03e1fd99b826a1ba90f445f419f06443267217e10ee8f1bf96296c6147542786a12b5dd457d08204f8483c47b7c87
SSDEEP 96:nE/kRy10t72wpvWMoiVmdeHk4DgUWQyV+VDCziEwb:niksm72GWMXhgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5b429476632508628a017d42afbd876fbcfbb21c5917528f2c9f4d779d07b984
MD5 0f200817d10a58204d184ed555579d66
SHA1 752031639c05716de5033f033784c30f0d679819
SHA512 3367d4443b90c7343376537e041eea615833dae6d8ae09d1a39c91e713a89fba499c13a3fc188c6b6555ac497586e0ab90491b11956787fd4465c3105565906f
SSDEEP 96:nE/k8y10t72wpvWMoiVmdeHk4DgUWQyV+VDCAiEwb:nikbm72GWMXhgrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e0222eac1c98738f8ef9c4499166e9466d57ec3d4593b311514cb04e16911682
MD5 952903cf92a8f461f5521016d2d754c3
SHA1 09331890d2657623fdfe3c6491ece7b09fb1f767
SHA512 73b9d5edfaeca9a87097d70ea849a2798aab999a2c3747a4c2e0c5602cf6db6ac299ceb19f1c975066dc75f8d4a2c56c7fbc39adcb24cfcf719eedd4cb0c0a32
SSDEEP 96:nE/k8y10tD2wpvWMoiVmde7/P2kZDgUWQyV+VD7AiEwb:nikbmD2GWML/P2Mgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 204B
SHA256 ba4266719369d7e9c953f788b5148883b564c53ab4bb93014bcca6fac8eb2372
MD5 500133c669f697cde3b846f3ad92df01
SHA1 41fa67cb03653d7f0790ae182a93ad5b3d45c075
SHA512 1bed9e7674d6cad68b9c0c2f0b8d0c20e52493c63d95319d016afe9c0d1a59bc18b514d1c62d389b1701576757ea6e4e4d47bab08f271a7ab7e9db860c10a8cb
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe587f3d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587f3d.TMP
Size 204B
SHA256 89c5edf0b540288213397b54d34253f196033c7d608e1987826682347b12be81
MD5 edf018fe2cbb4a6a934e32f73b76926d
SHA1 becf53abb9e0a16c8398f18b12a3289512d3fde2
SHA512 4f6c48ee1651fd1236ab4b24a213f8baad7b494b829160fa519cf9ef3fb910c5e0242c4d086e61e645a6a27fa80029992e9deb6ca0e4c656fe4248a454f64c93
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 266a589388012ae78da34d9aa3207c512ac71f745ffc9f489c3500e4725a4f2f
MD5 77888700ce3cbbc3a4b0410f4eadddb6
SHA1 df8b1d6a59cf9b3058e170250b92bb4cc49b538a
SHA512 0c679a8a8a43f6a5b99c85fa5068c9b2ae3dc4a332304a9fa521e21e18c4aee03cebe97f433b878d7e0459cabbc5d1d65cef4f0d9f8194e0c5482c72fa2eb5d4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3K7e2RUOy4Vv3z2OMDCRHi:A9iIxuERzA83h09RZxYApvaOMWRHqlW8
MD5 SHA1 SHA512 SSDEEP

Submit Download