5d3feac51f5cdfe53fca2b61846869033657055215c53b2e558579281867eda5

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34a51899e8a273d238f44b563d5f5b27_JaffaCakes118.html
Size 79KB
Sample241011-n1wsvs1arc
SHA256 5d3feac51f5cdfe53fca2b61846869033657055215c53b2e558579281867eda5
MD5 34a51899e8a273d238f44b563d5f5b27
SHA1 20cc30041ef7ce503c5eb9f47f99e9e89a35ae55
SHA512 b1eb7e7e0f03edf874cc8ab347f95911895d3c3817e8067adfd125df20a2b3b44518cd008b8e685190ea79882e10778faf654a3814763c0757a402f4eb5ce7bb
SSDEEP 1536:/LIP7Dag/IR0AUT0AURYlaq1Buee1h9A8V3iZGMFSe:DIig/JAUAAURYlaq1BveDPYZGMFSe
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
2176	msedge.exe
2176	msedge.exe
4388	identity_helper.exe
4388	identity_helper.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4428	2176	msedge.exe	83
PID 2176 wrote to memory of 4428	2176	msedge.exe	83
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1660	2176	msedge.exe	84
PID 2176 wrote to memory of 1664	2176	msedge.exe	85
PID 2176 wrote to memory of 1664	2176	msedge.exe	85
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86
PID 2176 wrote to memory of 3484	2176	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\34a51899e8a273d238f44b563d5f5b27_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7d7246f8,0x7ffe7d724708,0x7ffe7d724718
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,749620099238856949,3370806921221751883,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 af4d6eebbcb47415f7319b6fe93bb44944fe0c66e893b74c3e51818eb2cb198d
MD5 7bf966b1eacdf19857ee969c54b147ea
SHA1 720641c1f0a9672869eae5e209041d924151c754
SHA512 ffb4c43c71965176b79ddef6468a17fd7ab9229503a59c9b81fb671ecca510a4bb3f943d047d333aa4bd6ce5a6e0476f068a10156d5e3726617d78ce703d42c8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 3da50fc56c45cfc43421a515a28a11dc225af072a1c77b595c85e258f63eade2
MD5 95a85f8dc92d4894a0fe18cca5528caf
SHA1 75ce2594eca2da8cd996d09679a6d2e19eb6d896
SHA512 2a281580ce104887f7595a9e4e463a56bb28438e525f3155c89004e4f24fcee7b7cd717bab25b85ba6b6de81b30559640e031c13c22517e640ac222d8a626fd8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 15cb865838a677623da3740db4bcc81b2aac3f38c0e00159ea688a04b27cd122
MD5 218e09ac4a5910ead84247e277e500ad
SHA1 cad2d1f8057c17cbd9e3c9dbde2e96d9cfc5bbb0
SHA512 f95b6c8f0bf92cb3f0908658dec33fe7662757173b44413a7461992bccf4a70a6627a207ae046e82c735f0f090e9f071f2fdd3ca58ffb634c35fa2231f04b5e7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1969d6a4a49e852ee851fd4f3b071622619eafa5bbb1af556b6f69f978a5a0bf
MD5 5cecce63b5f2da9d6d7e80f20e5674a8
SHA1 341e07ecee898f6e1015a8d18bbb6c3355813df6
SHA512 46e9d840aadf6579ed524f82dbd4c9c2759755f146eac0b0f017eb62bebee2ca843f5c9db567dfa0971bb958a5776d075ccc28126fe4086701729850324af123
SSDEEP 96:nBFkAxm/BQYmqxhm1LxWI/wpvWMoiVmdeHtuE/xUWQyV+VDCziEwb:nnkxKkmdxT/GWMXvro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d0827af9185636e8f38ae0318531a518433a180437b71c1338275548521b8122
MD5 8869df1a3594708fdfd908951886d286
SHA1 e2a789c81122ddd311d2e7a2bd2440497dc784ff
SHA512 b91ee9aa1f289b25e2b17f01eadfd2133b96d2bb92a36602c2a60d0a1b9d12516b0d8c3babd223fab5abf2df3119bb4d41dc2d47842c18884ca6b8795c609802
SSDEEP 96:nBFkAxm/B6mqxhm1LxWI/wpvWMoiVmdeZith952tuE/xUWQyV+VDCAiEwb:nnkx/kmdxT/GWMJith952vrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f4e28189ab986b1a36b03b0dba90fe1652b02ae193a96a60088d3c2c58d6678c
MD5 7891ab9a1ca8892eb718a510ac905897
SHA1 b33f7370ecce838ef7c6d7fa149440464838fdab
SHA512 6ddcc944f0bfabcc5c414893eb4d51636250b33045a66345b82bd4d8da58bcffb7d9dffa9713a225295cd58f7f751d705a30f57e759c2f29233bbd5a847d06a0
SSDEEP 96:nBFkAxm/B6mqxhm1LGhWI/wpvWMoiVmdeAoSith952tuE/xUWQyV+VD7AiEwb:nnkxjkmdGhT/GWMwoSith952vrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 acd18309830ca2be1c10070821d646a4e0c25d42bd52f053970942bce1b1bf93
MD5 ff8be051ee38a2b174a992817342e1e5
SHA1 2c962de1fd629d9b469b16cfaf768f041beed91e
SHA512 161a2dedbdf5ff7478a905ced43820f3413795c3f5e25ab38af5d55beee29a62762a41ba00cf5b38dbb2aa5906d9a86cb06d90cb8abc939ef5caf69109bf93ad
SSDEEP 96:nBFkAxm/B6mqxhm1LGhWI/wpvWMoiVmdeAoSith952tuE/xUWQyV+VDCAiEwb:nnkx/kmdGhT/GWMwoSith952vrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 3512ad88be0d91838b8d77be2041aa9870a864b82c8c97a05aa6145c254cb30f
MD5 81cb77798f401038d3070517c897c04d
SHA1 ff0c800ef245e8c42939d1340dd02837d1981656
SHA512 5d7f6788d472d53cda107010789a9836c042e86c210925f7a8c133906b89fa26934b9fadd24b8c0dc023bcca3f5a36692c7e9cf8c7f372f909d2a49fdb1e77b1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe580952.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580952.TMP
Size 370B
SHA256 2e6c3f3ab813fd805faadd1e09e288f1353b44f16e0256b2cc244f03614d0912
MD5 acb02211d0341fb47a8e923f08b94bb7
SHA1 e495bec616f73c275c3ebeb000ac679ba663dee6
SHA512 36425cb9352c18de13b263f3db72c6b6d01717fab393a6a74b16ed1e825f07be3cbdd136762ec8aae9d874ebe444107f337fc8c864fcd953c57536bd90ce23d6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 2206f9d709a35182ab23aedb0ab70286668de73f5ce0972b82e007a043b8569d
MD5 15ae1c0f4513c9eb2e794fe8cb2c41ba
SHA1 4a3fc442d626fbf0f84a9ec6cd9b476d9ee004e1
SHA512 e795ec8b50b6f8d575e16b6223a8fa155d4525294ca73767b46eadf407e452b2ec1cdddf0b8fc9f47809e33338f451a6ff5d87642c0174fe85dd1fb10f4d5952
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdDe2RUlobZ6+B1EuuPu:A9iIxuERzA83h09RZxYxFrbEBPu
MD5 SHA1 SHA512 SSDEEP

Submit Download