282942751a93b2277603a7dd20a10437f9f1893687fc016c84a35d35ff61c283

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d37a5a7e0b0f215b09dadfb8b25a124f_JaffaCakes118.html
Size 282KB
Sample240908-ef76qavckm
SHA256 282942751a93b2277603a7dd20a10437f9f1893687fc016c84a35d35ff61c283
MD5 d37a5a7e0b0f215b09dadfb8b25a124f
SHA1 a49d453e8de0e6906b10f52d63ecba2c312a7c66
SHA512 28f0ae39a962470b70a3eda58c4646d11ab5e77fc678de4f3b523fb7d43517c0ecc19c2a0182b05c47e8820a91f3e08760c7c5b6a3c074ab1f1d4f9191c02b7a
SSDEEP 3072:OSW6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/1BmGg2V3VY7RJvfy3d7OZE:WDAXmNR8/Hn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
4276	msedge.exe
4276	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
4052	identity_helper.exe
4052	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 2584	4276	msedge.exe	83
PID 4276 wrote to memory of 2584	4276	msedge.exe	83
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 3480	4276	msedge.exe	84
PID 4276 wrote to memory of 2896	4276	msedge.exe	85
PID 4276 wrote to memory of 2896	4276	msedge.exe	85
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86
PID 4276 wrote to memory of 3172	4276	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d37a5a7e0b0f215b09dadfb8b25a124f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff631046f8,0x7fff63104708,0x7fff63104718
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1752 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,671299333461955157,10654415642929762057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
MD5 eeaa8087eba2f63f31e599f6a7b46ef4
SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
MD5 b9569e123772ae290f9bac07e0d31748
SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 24KB
SHA256 facc5d448f6e3267100a4c236f09aa98bea1cc3b19e2b2a0985501ca499c4ca2
MD5 d1c8fc93e329cfdb4cef6b1363e40db2
SHA1 2d034d8d0056a8c1596714c7129fc31c74a2565c
SHA512 07434e4af30064d5f67158d10b704afccaa31f974ccaca5e76dc9f1b05d76106b44f124c3a94af93eb1b44a5aeaa70ebc33e0f9f904d1cd4c8386b281735d008
SSDEEP 384:fmkqzlgw4CtpJByzHvyMPn0cdWgrlF1xUQNaASTJJlqC3Ix7RQLSKYfkXZzaiXMg:ftqirs1yZP0yVn1+QNliJJlqnx7epZ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 60cc5833a758270f3bd31beb0f159889faabd70410c2e92d1bb1f30b9ad683e4
MD5 3075d06b1ea1518723e55ae3dded876e
SHA1 dc649bb07741f135b6a7bd304a139c6573862467
SHA512 7b033d0e60269d1926382ab569a2f85cf3fdaaa1fc5b6bab5de42d9c71dacc51db2c8cae5dd3882a861ca273c2a32ac3b86f3c4cd173cc7268be4befe8bcc86c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 f5f60aa227172bae61a67c7a1e067ad503a6fa4432a836821a97d7309db1d22e
MD5 ecef0a87de803d6b6094fff012eb3ea8
SHA1 e8f5d18d0d05a129cee62db7477ad9d81a750317
SHA512 226c7caf8672dbaf47211b0bda483116120f79a081c0cb53ec8671bcb9b8ca05742d65e94e26f8ef02c9cd23e611b3dea04c21632a12783140917c85b85ebb02
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 bd8c70318188f60b9b93e767923ca1beb974ebba31f9674b48ab7fd3b01ebdc7
MD5 91684f8b4238676e14c639f0e02f790d
SHA1 bb4b947c8688edf29d39b178057b28345a165688
SHA512 654da736d67f7ea6d6cc3f0baf77f38f02e6f96dc5d61a5b93c6da91fbee8a2b2f600779aa489d578b6a45fa874a459047e7499e931b155c36301b590ec289fa
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 e0cf23f4db8f7cc36987efa5ed2ef20e171976c8a67de4f89d51de4b921e2171
MD5 e4c2ba30d4e3c4819b0c71cfefbf1711
SHA1 6c11df8118292b81638a139147072a8b199e4745
SHA512 36a5e2e3baf03d757fb2377f5e41663c92b0f3fc05a6e9a9336b2aaad8a56d37465d5e2d0de4592aebca9f7c8b1052ea9c4447c2af7737e377fdc44a41d83f43
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 b962284e3f58ff8b785d6bea4af5010e2cfbbf4b497ad73bc2643d3649e2ca44
MD5 a1a33a7800727935958539f3473fd711
SHA1 8ad2a8fd006f5b4d291333d2812d25a325a9373e
SHA512 caafd6026f82233d9a15d46d5071a6eb763104620ec2ad00435004d0577a904513273f3f95ae3965ffcbd5734d67b73793bd0bf1c4b98ee7684147ee8d2d8539
SSDEEP 192:nKk/7BcGWMbaeklf/DMqDXMsRMl8ErvcIk2aMrg:nKyBpWf4Qyr+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b81c8e766f8ae38de7a0ba78740c66fb2320e9e68bed7711d0e8e8ebc41b7257
MD5 18a4aba9dda560d4f7fdbd141bf54c17
SHA1 6cbcbe07027e7d3f0c6567edd553e9afccd5b49f
SHA512 d9fa177159412663a94484df93f4ae4e6e8d0206de32055462b9490df72c41e7e5591d26d61d4ddf201c06c7d5a64a20ab9a7184addfdab66a9a0ad1539ab35d
SSDEEP 96:nKk/P31DWwpvWMoiVmdeLeklf/7Mc8Gqqk8rUWQyV+VDCAiEwb:nKk//hWGWMbeklf/7McIqhrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 39bd28a1aa7cad445663a9153f9601335f29bc75365fdb764deb12ad63bbfc8f
MD5 7469ec01b291ae424bc183fefad1789c
SHA1 04c77e2f674bd9d97b7056fcb346b8de4463d065
SHA512 cd5db72516902a3d2bc398f467105c1b16914f41a550828ccbb64559e6a7f9e96b906fecaf504e72de49bf8ad53f5445cabc521fb4f5ca839125b2bb7c223496
SSDEEP 192:nKk//hcGWMbaeklf/DMqXMRMl8ErvcIk2aMrV:nKahpWf4vyrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ddb32b64c832ac8c69dc71217cd0f57b5fc0cff2f2cea6f72199bd43df5a4397
MD5 571831f88a9f4901a88fbd2f45004acc
SHA1 8d5d85e8aae933aea8ca10e8ae48eab6f5695bc3
SHA512 82592627b41033335e2f1490b18bbc3f2c4e8cd518f1b5d93528b9001a2faa6b346278c29400cb715713b19521920eb01b5d1e1b9dadaead2110c569270b38a8
SSDEEP 96:nKk/X31DWwpvWMoiVmdeHk8rUWQyV+VDCziEwb:nKk/nhWGWMXhro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 706B
SHA256 fcaa8d89a0e0496634d63e362d51a89393371b158fd882764a67e9db3792621e
MD5 bd596bcd06623d9d4f3ba2d708788917
SHA1 14e766fc56f24bdb1569da764ed49bddd9c56cc8
SHA512 0535959c876b3a9b1f2dd5bd7423dfe56cb711138de7745da56c4a012a464897dcd9c907206987741b4d314519e2c350278bee957bee66de6439399ad395fae0
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 871B
SHA256 a2d540e32ca71e2c3e6d8c5a4337cdf4f3ef24e00da4b45da7d77a4499912fa7
MD5 df69df326a93b2285b255da3b39d0b00
SHA1 973869df1cc7cbaa964b306aed74794936053039
SHA512 8214daf0acf7073ad6252e0914ed4bcd873e47204cfbc1d14cf76a39c23c6dc5ef00b007ff58e31f3fb40ecada509aa92c87011d485081db0ca85e6a4240e357
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 d2d989d20e404043879b88def0f8986bb69310479db05c4ddcdee041a386dbe1
MD5 d0543396ac63074b6dc091ed88791d7b
SHA1 3d38ea4866750149bb2b198f27aef1ee2ba820ab
SHA512 85ae51a906bc0c0efbbffd0b0f12847ea2ba15cdfacf4fdc287d286ad203fe5e852d441c6a62e68da297967b71694b7cd7595d7d80891f0b2a1b85939cdc5115
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581ce9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581ce9.TMP
Size 371B
SHA256 6e8641036150b544d85b5a6aa32b659046dfea8fc364f140bb498d6fffcd1d3a
MD5 ef8b4cb77accbeb66d25c09ed7556b66
SHA1 9073d0c95994495e15851314da14fdddf7afa373
SHA512 1df28b360f87dbdb1d61df8ab68076b3521f3dedf981ae06e2b00aa0262286febd5e7ecb287c1a32ad08d6de199392ac8246224c8a2de5896df6be87a7d00e90
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d135ab99dd29a27adbadccf85b3047246f2131c94561bbacdce1cdc3e68a2e55
MD5 aab874d65a12ff35b07cfe257b3999ff
SHA1 0662e49535a7cf7c39e0cdbbabb5d40398e2866b
SHA512 8192d214a29a5b44a939c66df2e140c6d0ba3d44114aa96f731ca7d71890733bce74061b4c5cedff8055e4de85a055c0dcb9c316ad9fba2d9a95aa903d55e84a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup92e2RUoxnkLQOl6feAOMM:A9iIxuERzA83h09RZxYuTkS5M
MD5 SHA1 SHA512 SSDEEP

Submit Download