95c81b3a6992f25c5b82e0d7af08da6ae397083aadd47b550b81cbc7ba5a3230

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e0638822733d9576e996e6061140999_JaffaCakes118.html
Size 282KB
Sample241016-vna4ysvdrm
SHA256 95c81b3a6992f25c5b82e0d7af08da6ae397083aadd47b550b81cbc7ba5a3230
MD5 4e0638822733d9576e996e6061140999
SHA1 5f8e5c0b4f469843358bc6cfe254e484a92b2e3e
SHA512 96bf02eb2a978d43bb203e8893f5a43a229355cbf1878262675a6d056cb5f98086f901d51645ba12a55b40b6f0ccdf04b3bd09f2312b944ef259f5486cb0353f
SSDEEP 3072:OxW6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/1BmGgzO3VY7RJvfy3d49/z:nDAXmNR8/Tk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
3884	msedge.exe
3884	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
1436	identity_helper.exe
1436	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2160	3884	msedge.exe	84
PID 3884 wrote to memory of 2160	3884	msedge.exe	84
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 1984	3884	msedge.exe	85
PID 3884 wrote to memory of 2668	3884	msedge.exe	86
PID 3884 wrote to memory of 2668	3884	msedge.exe	86
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87
PID 3884 wrote to memory of 4112	3884	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4e0638822733d9576e996e6061140999_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f2dd46f8,0x7ff9f2dd4708,0x7ff9f2dd4718
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5584 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1853971778165481732,13044324616780919494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:2576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
MD5 SHA1 SHA512

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 23KB
SHA256 60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf
MD5 2f24e0f5d2c2997a89fb4a8d943c141f
SHA1 99515bde1a5bf72105116ac902ccf3db1dd3df29
SHA512 0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d
SSDEEP 384:VSCKOXcXVC6fizIN66yBc1Ei49Zvi2fSZ886pETkDCm510VS7X+r27Z:aOX/jd6yJiOZa2aZZNAFmS7X+rEZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 339148acc9abe1ceb13e4308aa39a65b118d0763f962336ee4daab4631894ef1
MD5 5c2c745d1ba461285d812855724f2806
SHA1 c5bf5e4713eb41656bf21ef9b87b7494fd0be00f
SHA512 e25a0ba1b25d664e4f6fea4d79ac25f728572cb76fb322356803259abd9adcc1d1240444a0a5a3e95303b09c1c41643937df7d17dace0a36369a1c7219004a28
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 63c90600e383e334a817a47d8a404d7610ae0e07cd821c37b8429a6b365bf07f
MD5 afac4c32c966ce14b71340e0245be570
SHA1 1e86e6579d6be58de2c07cee85b54825f9970140
SHA512 0d2f812c5d859c21d9e5170272a3e191f34f166a61b18aeaa3cb4aac402412931b45442954680f65538c01fba601cf3ef7a60f03bb5b9bc180acb55fcfabff3b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 106c1de9fb3ed6166bb06924a9b3c9075054de39a2a7aada6950b2237a80ca7f
MD5 ccb572f467b8e93d58e89bdaa0d799d6
SHA1 15c1f6efa7219aea618b4b445731388e7af56f73
SHA512 7c54d4d73ea19eff50775c7200777cf7a13e0e5e0e81aa86d5412575cffa86576dc6d5a68b21abee0600e24111a181001d12fbd67fc600be1b43d5ff1ec8b1dd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 416d8331fe3432c01e673e87c1d61ae8023cbf3482ff8318a02ecf4197f57f8c
MD5 47624bde39e7b6a5af324d4bfd446048
SHA1 36a5c92a8c529c5ad75e93b38095074f8f4538e5
SHA512 70ed9d7a25d3ef27d3221ea66ae238a1c853a10ffd13b774eba7de82ac09fdd8d75e20eddfb562794c3e3f307894ef6f16beb2ec2706ec8b4dfe2d0326321f4a
SSDEEP 96:n6kMxm/BQYmqT1Mb09wpvWMoiVmdeHqZzAIUWQyV+VDCziEwb:n6kVKoA09GWMXcAIro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 95a33d9f9b1ac1f72f86a3f9335d98e984e7074b61ee399227147a6358ea0bda
MD5 d496e122e521b2ade116308a6dd17938
SHA1 cd20cfcfffa05cafc9d374e03ce8bebb9977c712
SHA512 3fdba5ff34e4e76ae5311008da5b3ad47a1a68f9d0d65f4d851363d10eafadea10217994b902f8e4d3f7de2e1821b14e3b36f9abddcc4bc76aa4c32d75581119
SSDEEP 192:n6kV/oA0bGWMsmeR3fhNMY4vRLNlErZboj2wAIrV:n6BLqWLAzArIAg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 2dff3c14f049695d65d15827a4a908f38035fcd2a5a8ce78c4eb6c0a835e2568
MD5 107a5ba59af5b0725cc748add663dd1f
SHA1 963712ffdc8607fbed21716e94732b7d9e14568c
SHA512 63b3846a55659f47d3263bf90999036de1f780eae3e82fa7a823db3595b2fc131633821acc216def62338b4d7fcbafa1b5db872d81def016b8cd35c2be8c4128
SSDEEP 96:n6kMxm/B6mqT1Mb09wpvWMoiVmdeceR3fhkvb8G6qqZzAIUWQyV+VDCAiEwb:n6kV/oA09GWMseR3fhkvboqcAIrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 0a160e250aebd49bb75e396bb1f146142f3ad5dd6d0d5258f4c2ffda0687946d
MD5 872f1b76b8d56d15694be30d82e0767c
SHA1 838694732c32cc578c31eb8dddd3b06d62e75927
SHA512 21b7450748aa18b3872c36b1770259ea23ade875cf40007578b7dcafb78283f32c5684cc8c0a6b612c7a5f152004b71f6a56063a2938ae85e61b28242e827576
SSDEEP 192:n6kV/oAQbGWMsmeR3fhNMYu4v0RLNlErZboj2wAIrg:n6B3qWLABArIAt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 87981a44d120851d10a98fff1a9c8318b583d123768da6741bef6d2fa8d58379
MD5 d60a038d83561856c5d53679aad77f3a
SHA1 daccb5382967043391afd8c437686629d0a27289
SHA512 2cc95df7636397aac3a9ac93bdbade5c103b6c1163dedf0aa7b71c7bfd3139f1efc72e102be9fc6808d32d6ec38a5bcd6e4f705054f0c8e96b4fb6a6146d9834
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 04b6f02d392e3bb9bec6fdd117ea4c5138312582b7575e68c12e38ae0fb46eaa
MD5 dbde3309f0f22a0fc3cea0df0c302b08
SHA1 b3501054631440a8e83066422e3cec201b601185
SHA512 9e4bbea5f9222e90dc7183fda147aea32f80728b38ea3c13457080f5900f03b8fe5aeaa3b80e7e94515def473950f2613d222256b13b12a904236ae6808693f3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 2010835a3499e553ecd7fb54878c79ee90b933103defdef70e69c08c366fbe62
MD5 df04455bc7d175edd8b48dda47875928
SHA1 98f4e939c2ab0cc165a3f49c41c84a7f8c2fea48
SHA512 3bc0f0d2c4b181470cec4b627d2a78d3f06e1055f77cbd3dc4714af6236110c6b29d1cc16776bed6233301dfb8cf631c8546f6be3917be918d232dcbc654760d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581ab7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581ab7.TMP
Size 203B
SHA256 2011c59f474ec2e0be06398ed3b49ea99ef7cf88bf098f6a9959f17f87601167
MD5 ee179e8513ec562989ab5d1a9fb4b496
SHA1 6e1f1b939ed315b5b258b5bd7195aa36439bcc7a
SHA512 7c502f4259ca79172a1a1f6acd0c70cc5fe11b022bfb0ad57d89e6cf4754b468e87a3d141003b117ad4931660926ed9d96480160bb02f5bc034d4473dcc88a34
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b3146fd1aa80a65a8652f5b4bad6d5b2969019b8f0f1017b7590e40affa86b50
MD5 accd77561c2e70c79da94fb34640746d
SHA1 6d1b18ba392a5319f32f801154e17d33e6581691
SHA512 4930cb58117d16fbd6b2176872ba9fba8cdb836ccc564eecbd7156e6a7b6bd6894416bb3f5db59b9972e5fa82f4035de7e6a93bdd29353898cc667c2b3d7938a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupNWWFFe2RU8eDSq6+B1EmXe:A9iIxuERzA83h09RZxYNWqhMmKbEM3u
MD5 SHA1 SHA512 SSDEEP

Submit Download