9f7c2084915124227f931fa92882206ab77f91c78a1b55c8e633fcc0932a0e3c

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d58bb452332c11ea40280b180e187542_JaffaCakes118.html
Size 7KB
Sample240909-demmysyapk
SHA256 9f7c2084915124227f931fa92882206ab77f91c78a1b55c8e633fcc0932a0e3c
MD5 d58bb452332c11ea40280b180e187542
SHA1 8b04be2e63626ffe67f8bb8eee592e727908cc8f
SHA512 d674150ff3e3852305bee35642c724f7b74dd745527ea98014dedd4a9d306ea55f4400dba3b9a50777279004faed7ba276c0c98341c9ba94ef5aba20ff31c197
SSDEEP 96:S9dTVAFGuVrktQmdMNl6Wbu98IM6tfe6bpa89G83TcnrHLZ/AFWr0iZ:S9dSFGmkCmOQ8Z6tm6bpa5rH6k0iZ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
4340	msedge.exe
4340	msedge.exe
2204	identity_helper.exe
2204	identity_helper.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 1464	4340	msedge.exe	83
PID 4340 wrote to memory of 1464	4340	msedge.exe	83
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 4548	4340	msedge.exe	84
PID 4340 wrote to memory of 3812	4340	msedge.exe	85
PID 4340 wrote to memory of 3812	4340	msedge.exe	85
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86
PID 4340 wrote to memory of 4556	4340	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d58bb452332c11ea40280b180e187542_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff969e246f8,0x7ff969e24708,0x7ff969e24718
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2396 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,14498818012333729795,14585303825229772012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 212KB
SHA256 7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1
MD5 08ec57068db9971e917b9046f90d0e49
SHA1 28b80d73a861f88735d89e301fa98f2ae502e94b
SHA512 b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf
SSDEEP 3072:tG3zu3Ek6OGff9u9xmHDyzB2m2niCRYd16kwEaqKk35LaHahdU269cWQJWU7/u2Y:tuNH9BHM2niUY+kyqKk6mCT7ULuoK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 4d6343ef5e2fe84b7088a74752e6062148ee10d5b210668906be60adb5b55afe
MD5 4a44279c6bd7a7f450e9b5f0fc66dd9a
SHA1 a384f53a9675efdb0e85ca3be8588271c48732cf
SHA512 3314c5efc95371ac9ccd3525ec3b29f9acb7112698700d37fbe98dfd73844643b5aa52b83f8c48835e0246d7bc2341b9c11c2fbc592e6d9ee440080f85ca96b6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 057685aeebe4f64a1c0ed4cfde51c03994b71801e95532189e0cf52b68adaf1c
MD5 ec575ba3469234a7bcdecf9b8a691791
SHA1 36d42660e1548fe18722ad6da063ec81adf15f3b
SHA512 17f7e79449b3da96e9d57e3dc0b3be503fec4c981947403b4ff3862dd5002a4e71d762fa8c30027d2d509c2531df0e01ab2de34342120e38f044e23436534287
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 fa05bfd5f618940de7928d22a66f969195a47d30c387d178933cf3c990099985
MD5 be56a307dfd2d2ac3faf2136de28c34a
SHA1 86783c1ae7bc9861a1031ee11b3a9a44d7df7b07
SHA512 f7c9d2371bccb694883ee39d28dfd3b4f54be7024764fbdf40fdbf00ed60f40db2cafc4bbb1fb0d40e755b9e360422f4afa55b701e795c7dee9eb9114ff8061a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 88551c9f9ddadde140cc99962769e131345b0439b77ce84f862c32f312af19cd
MD5 71d0732942fefe4fe51f441b126a57fc
SHA1 afcf7f2df67fb594bf5ba088862f77f93b101336
SHA512 b76819196381cc813bec80868b6b5fe7ce3658a316a2298a6dda71a535f53d8669613297ecd88ca5a5ed73b28eb89f608c8a58a5c559d9b9b02c386bddf02b34
SSDEEP 96:nvkdXw1RvjpwpvWMoiVmdeHm9z1UWQyV+VDCziEwb:nvkdATrpGWMX+1ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8bc6ef0a9d86359ee2ef378409f1705581e98efb8ffcf5a609d8a887d606c8ac
MD5 da8aa7cf582dce257659e66bbf2b38ad
SHA1 05f3f96230ea83faf38add3b6e6f14fdf9c06b29
SHA512 84fd6263e72ce3b1279c81b15d842620fd93a884564ff4ab55721ba1064b2199137056a10960ebc38238e0547698ed16b45ed4c59b9899837c4707d3738008d0
SSDEEP 96:nvkd8w1Rv/pwptoWMoiVmdePfMQ2m9z1UWQyV+VD7AiEwb:nvkdFTXpKoWMf92+1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 8492b14dbbd655aa72144b8e388f2d09f989b2483b23166834f066dbe72f92a1
MD5 cdb4ed2176e6e992faf39e5cc0fdeadd
SHA1 fe2bc58d6edb62cb1e7ca45ebdb1b45e49986fe0
SHA512 c6c83aa8ff436b624f9b4319c10e5fffa3a622192173ef2997b99947e5de136e874bbcecd6e2bb686c8b105b1214acc63f11fb58773dca1d8665aafd35b8dab2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 a469df15b200a5837872f0f933dd460023afe18e58f90c1086fc32347e441b23
MD5 816993834b82597f086e36e1316118da
SHA1 b4a509706dbe706f5a35950e63d984d20386324c
SHA512 e92c5512ce62deb167301cf06da282bcbd262ac71148d74ad77fb3538c63362d74b82dd198cbd064623455e43287940d45991b25cb29d824db332504feef82c5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 863f0368efe1be82c86f5e58ac12653fbdb8837d0f4ac5d12a71136f86e6be8e
MD5 de8c0b7f0ebbcffc59fa0b30debf297e
SHA1 bf367f73dbd2c619f3785d807b198d3546165ceb
SHA512 d20c82949db9a891a7e9d3605fed8946c6ff89e06426e633abb7c806893e9dd3d31541f216c4249adf11ec964a2081b4d813b05c93ceec8b987bd2b755ce35a9
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57acbb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57acbb.TMP
Size 1KB
SHA256 a636e9ba19af87f121483aaa0e4854ce144a8b317911cfd13191d5ff27a3de75
MD5 79823d4cc1bc198689293d66c6f667b2
SHA1 86e7c60df4117cf252e77d410ba70404d4605557
SHA512 c57bf9ca9d439c6d24e6e58cd40989d96bba7b620afde3b5dcf13f1a28aa3393d61030d3d58387f9c109fae2c447f0b344638dddaf06bf641431e20442ddadba
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 35214783aca945449098e8b0cfb6356248ab7d63b81a4fd8c04235d5b7a76b56
MD5 c62135ac53d7bbb125dfe0ca09a08106
SHA1 4c745713061594f8bc77bd67fae3eb15973bb79d
SHA512 5e2b45b976eec5f765a54a32b65394d8d45bbdb399b6b0803aa86a14ba9a6d2f5fb72c9c90034e7e34d76b0e6a5f662c2e2810633ab59079136f77978fbedfeb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSe2RUclYOvTeuLJ5cmO:A9iIxuERzA83h09RZxYsbv7JCn
MD5 SHA1 SHA512 SSDEEP

Submit Download