a826ea0df07ede46756decbe2e34d88ce5a1e8c8d35430bf38917dc8e9d7593c

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd96e10e128ac0832e3d13cb8765746e_JaffaCakes118.html
Size 7KB
Sample240913-d6bprssfkb
SHA256 a826ea0df07ede46756decbe2e34d88ce5a1e8c8d35430bf38917dc8e9d7593c
MD5 dd96e10e128ac0832e3d13cb8765746e
SHA1 f14e03d6b0d01958a248d3f1cf09e28377bd66a9
SHA512 582f3e11c71bd34df15a1de125e6246f0875e540573b00258ff19055212b7d6a7bb8603b38e63218d0fc0cad9486b7e10d7ed6d5ea77155cda57700e4af573eb
SSDEEP 96:XdTVAFGuVrktzEZ98IM69fe6bpaC9G83TnvYbZLq288K6Z:XdSFGmkdK8Z69m6bpavbEOZ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
2740	msedge.exe
2740	msedge.exe
2896	identity_helper.exe
2896	identity_helper.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 4352	2740	msedge.exe	85
PID 2740 wrote to memory of 4352	2740	msedge.exe	85
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 4520	2740	msedge.exe	86
PID 2740 wrote to memory of 872	2740	msedge.exe	87
PID 2740 wrote to memory of 872	2740	msedge.exe	87
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88
PID 2740 wrote to memory of 4736	2740	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dd96e10e128ac0832e3d13cb8765746e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfbb046f8,0x7ffdfbb04708,0x7ffdfbb04718
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7351914893203540153,17025960697253392488,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2536 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
MD5 ff63763eedb406987ced076e36ec9acf
SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
MD5 2783c40400a8912a79cfd383da731086
SHA1 001a131fe399c30973089e18358818090ca81789
SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 212KB
SHA256 7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1
MD5 08ec57068db9971e917b9046f90d0e49
SHA1 28b80d73a861f88735d89e301fa98f2ae502e94b
SHA512 b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf
SSDEEP 3072:tG3zu3Ek6OGff9u9xmHDyzB2m2niCRYd16kwEaqKk35LaHahdU269cWQJWU7/u2Y:tuNH9BHM2niUY+kyqKk6mCT7ULuoK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 08178039d356edb401c1493bef1533954c0885120b6f5a2a46d92bc9bc9777a3
MD5 f2a16f15aaae085bc3b1704b8c652aff
SHA1 f11792cbde4c762c1b696a0b7016f2d227d71d7f
SHA512 83ae2749f3b1852d87f2e6f48b86ff3461aa4601f6e3dbde807104ccd60eaa9ebb4b4cadcca6653b815604baf52af0d97adc45aaee694dd6b98eb256adf5c6b1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 5a0e3db4677f018cd33de61edd3b98c00ebe8b8b78a536995e0a7ed7e4f11beb
MD5 7711900d13963c32ae8af34e0aba8789
SHA1 89a722feac5b1d456ec4ecb81bf7ea16d0fcdbf3
SHA512 34fa2b6c09790f59e41dce5dcf6e1c897961d9e0fe95a6610545e59fd94a1417f9b6934c84f5f2c53f856dc00e613949c347b91a7df4f20c4028770bdd114cba
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 67cad75735b0b91ecae3de226a2520d270eafcf0b3e1ba9b9943a6ed9242b67f
MD5 5bb755f9c34f7aa4a49a60fb8b5d161b
SHA1 0d85dc7eff9ff15223d55f842482543551e733a1
SHA512 1a80670cb0a833a89cb45f6e846d11b5c57a270a1b563ba6c2112713d89098e5d1ff415974a50e4bc10922c498de94c2ba8fa15546cca6da33a33ea7d307542c
SSDEEP 96:n2kR0CG1dg04wpvWMoiVmdeHa00AZTM+UWQyV+VD7ziEwb:n2kRgnP4GWMXVFTM+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d0335040c2bd2f60141a78377ac123625f64d30c009a3f234d9517c7143add20
MD5 5e31973ee35b5a2af7854d5838045c5c
SHA1 7e7d1a6440862b0d44f386cd546ec0fd9b744f37
SHA512 0990a7fae718dea5fdfd4429fdeef0c0a53bde3e8517ed3f54dff44a9b6c1a1478fcb606bc98a37fb03a9dfaa7a247c60c253da75163cdea857bd166fcf50504
SSDEEP 96:n2kRhCG11g04wpWPWMoiVmdeiYqfY2a00AZTM+UWQyV+VD7AiEwb:n2kRbrP4BPWMyYqQ2VFTM+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1f24affe06b3309f1c1c7c3846a667acd72948fbe01ee1adc566658cb48c07f0
MD5 b876834f84fef586f6a99760de4da58c
SHA1 3ded06da07999a5a6add5bb29e0fc225e30f9c58
SHA512 3e9e345392a7d7c3f385b89cab7974ef4dd9cc4fdda0d1dfc4303fcd01e6fa19f7eb0af13a260c4f908c3601d720fe96967bbc78530388325642d383e89abc56
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 386bb58bd774f1fdef16fc3414d9601f61131e15440fbe4b02e4a3136f14f64c
MD5 aff48a7b5048317095306812a89023e7
SHA1 6e39fdb83af4377b994e99a8488543492fc2a3bc
SHA512 2811bca3146ee33cb74b8cbfc42d63924b163395f3009c1ee5c594868acc1c5848e3af4d39a8a94c27a0a3e76591d28fcd70b74e490324107116b337487bad3a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5809a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5809a0.TMP
Size 1KB
SHA256 2d6b402ed74303121a2b4794d9d66a2bcace688a0d44871408c01f847d3ac227
MD5 d955e07a659f9d62cb6b06caf8e311bd
SHA1 4aa472f289d99aca9bc39e4458e23a57b7ab8280
SHA512 46cf67197ce9bbaecf4e7cc7b90b6055fc6592edfc73e9f2a04de71d9549b3ea08cf1117fc666b41cdc2d6011006e55b6b28e34ba2cf1cc6c08ad366348430ba
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

e44a3360-82ce-4395-9f45-218b8295c109.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e44a3360-82ce-4395-9f45-218b8295c109.tmp
Size 10KB
SHA256 e93c04edbbd6491f13e0f79f9e26f98dce655b934d668a3a5a34e7a21cd6b464
MD5 47663bedec7bfcbaec2f62d088e6d714
SHA1 a3a4c6c8be83f6f289cc6ede3fba569404643a5c
SHA512 cf6fafad480da7f19ae076584011d9e1fbe53dd1b205d488907457d5fc0538ec063e229fef6a1a17e561f79bfe177550db5db7cf4d12618d893a65acd116fc08
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup4ee2RUW9AzTeuLJ5cm/:A9iIxuERzA83h09RZxYdGz7JCq
MD5 SHA1 SHA512 SSDEEP

Submit Download