6b586c7d723902b1f0e58bd18ca4cbffdb2499ad796f07c7e931738d287f2793

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf5a2cde1d50bd30840fa5fdf6f25b85_JaffaCakes118.html
Size 7KB
Sample240906-mnpcks1fpq
SHA256 6b586c7d723902b1f0e58bd18ca4cbffdb2499ad796f07c7e931738d287f2793
MD5 cf5a2cde1d50bd30840fa5fdf6f25b85
SHA1 d98935cef006a787563019f9a2ee314bbc6c541a
SHA512 673c4f03e4afc03bb8b1310c9c09547c7b3783b3e09c8d5ac9ddfb099c2f2c4e8380b003460b7dc27a1a12a0b28c09e3c689a8937abc7aa8c93ae7c6d0d43a8d
SSDEEP 96:RTLdTVAFGuVrkt+Whxt0G98IM6tfe6bpaW9G83Tvm/GPZ9SqqdNAwA6Z:R3dSFGmklmq8Z6tm6bpaZ+PrqdNq6Z
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{1CC92AB0-3BB5-428B-A6C1-9D7AEFBBB27E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
4172	msedge.exe
4172	msedge.exe
1244	identity_helper.exe
1244	identity_helper.exe
1536	msedge.exe
1536	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 1112	4172	msedge.exe	83
PID 4172 wrote to memory of 1112	4172	msedge.exe	83
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1064	4172	msedge.exe	84
PID 4172 wrote to memory of 1984	4172	msedge.exe	85
PID 4172 wrote to memory of 1984	4172	msedge.exe	85
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86
PID 4172 wrote to memory of 2036	4172	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cf5a2cde1d50bd30840fa5fdf6f25b85_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc0a246f8,0x7ffcc0a24708,0x7ffcc0a24718
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,1788104293691102540,15159701290364740614,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 212KB
SHA256 7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1
MD5 08ec57068db9971e917b9046f90d0e49
SHA1 28b80d73a861f88735d89e301fa98f2ae502e94b
SHA512 b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf
SSDEEP 3072:tG3zu3Ek6OGff9u9xmHDyzB2m2niCRYd16kwEaqKk35LaHahdU269cWQJWU7/u2Y:tuNH9BHM2niUY+kyqKk6mCT7ULuoK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 03c120e440fcb47d0ce6600b4f65cf2b57dcd7bceef383c46eb037112182c9d4
MD5 56c93572f0b0a907c1a495e37dc839b0
SHA1 4d03a8d7abf56862b032d4e78bb2bee8f014bb53
SHA512 7d5e7a88fe9cc5401dbfddd671a5e3e9456a39589d4a4b0a91d4f5ad94560e11611de063981865c9d49697ff33312a37f66209f71ed51faa9900af6da46e3e2b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 6d86e6a575df7be037cd4b344596a87281aba88e4a568fedbfd869383c2395d2
MD5 0d64c3212a27027810d904bd955563d6
SHA1 26294a3e0023cd15b203209f7ac174b387595ae3
SHA512 34049175a67c59debd7c788ce8ca2efad1160763fecd0777b0113b667921950af11ac516fecf34d144ac20b69ff0df56aafe4f123cbde90928dd5668f7b8b755
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 fa82d7d943c30e3956fad0f77452a9bfe361bb222166a4cdaa234d9513416753
MD5 7daf74cbcc022e27b297bc5f68421e85
SHA1 9f95381d8a52ff3ce63dd5776404c3ed0459943b
SHA512 f7ff21c932079b9d066471cc12e3e4da3e4a9c125bd0b56c629e919f227d408028bb4c87c45ca35c0eb53436f68d1ec6997d43c2a2d5e259a5d23b3c92f9710a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c71ca094f15c2ae536deb965c088a33359dd639b63eaffd43027fde279036b10
MD5 8dba3b3aa300aa9dcc3dedfb7d18dbf0
SHA1 00e7745eb49d0b9dd9f24514a299baebbe12d806
SHA512 30765aea24d2271a3d9192dd568289546ffc72392badc1f1964c935612991cdd61f420c7e8b366b1f327e1d927843546ffa7861edaeaed4f19c32d256533c096
SSDEEP 96:n/kzXQ1aDTNwpvWMoiVmdeH44YA/UWQyV+VDCziEwb:n/kzAolGWMX4qro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 56b2a3c0fd11a428329b2eeb4d9764dd7c9926455bcbdc34a58f5723a5eb39e6
MD5 c0bce91ae26fbafbd9d667496537fc11
SHA1 7137daacc82888bbe716474185edf336c3e915a9
SHA512 a266b85935226099e00326a5a9411fbe8fceea3689ea93fb56c04ca7add4a34838c9d5d70942653fa8d165935c812d9664831f25958a799da486161bcbcf25be
SSDEEP 96:n/kz4Q1KDTNwpZKMxWMoiVmdewbfd244YA/UWQyV+VD7AiEwb:n/kzNslWKkWMAb124qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 066c62204bc0e3c830ff16133dac3b76905c241a9f9c8e8f39317baae12148d0
MD5 c45159f6874f14cb9f6fe9ff401110dd
SHA1 fcecd6f02fee15c77568bc6d9d8e95b79e3c819e
SHA512 7697bce19e1c488cbb33db48034c5f787a627da81a629d7290a67338cd8368cf57c9060986cc0626f55c1366c7af2f63460b984cce635d75dfd373943c5252ab
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 90c44dce8916eb5b3c4a122897285a32d788e97375124897665be7c3b893dc50
MD5 39d5a93de0c56053fbd8746406657b39
SHA1 e5caca3c26fb0b81c0e50e66130b919412e59578
SHA512 585afb957fe320ba28059693e1ed6fde013ad16c08de2eb2eec868dc90cbe49703482fec02ef57559aa08d0aacbf8ff6ddc679e4b03a6b46faffaeb8f11a3b45
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 9d9b0982ea51b5390072b6c7a3ec6e728e7f2df19c0ec85cdc3a06ab12f9db58
MD5 6e1f13af27467e0b25ac5fa446118ae0
SHA1 d843b71989008ede13226cf936e34e0a2791e221
SHA512 b73e72386a5f0e8db43ed7dc23adba4f8ac344a18f92b099d1b7e699e0beede20fa5ef49cd2b525b9be942ac3b2f03c2ac1c597123dfd3e64e0c3921726dc900
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b16e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b16e.TMP
Size 1KB
SHA256 89ceac8becab8707895ddb44df961bf8e16062c893bb7ca8b439c5f282f4506f
MD5 122ed1c5bf1cd8af5d013ce00302e52b
SHA1 5c5c6a294486534d8b8073b1cc2d4cf21cc7eef1
SHA512 02c84377d99b6625c154b4f6cc15cb92867c1a28bfd029dede7ecd091548628d8617cc7f3564a5b22ddd113cb8df718f1e6577cd9f999a360084b6b127f80da9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 608d1765e0d05cf39ca9ad69840a26adfbc8132d0162bb77b081019557afba92
MD5 05454283ad2a24b00980690101d598d4
SHA1 0da5c39a9561948bd8e1d76d81ca464088266fe1
SHA512 7c80f0c4124c68f48412aee8289475b3f1699046300b5ab554a0d457328e654e0e22d21e61a696037b480d7d2ac225cf250cdf09f3031729f40352f3380aa287
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup97e2RU+OknLQOl6feAOC:A9iIxuERzA83h09RZxY9rTnSz
MD5 SHA1 SHA512 SSDEEP

Submit Download