84cff54733b9aa34a70a03a0f9f26319ff17b90d5785d478830cc1602b4ac506

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
505276ffbf6de691ddb5e72515540f6b_JaffaCakes118.html
Size 153KB
Sample241017-csentsxdlc
SHA256 84cff54733b9aa34a70a03a0f9f26319ff17b90d5785d478830cc1602b4ac506
MD5 505276ffbf6de691ddb5e72515540f6b
SHA1 8896f88016a827d982ccf23bc75337afa0dd1e45
SHA512 6317782d3b71c9c9bdfcd1b7b32f48c222f9156b3db1a61daf1474ab4f0a49f07340fb84d65f611601caa3d9bf922ff0708f0b4715480e3f27dea431cc122524
SSDEEP 3072:GxDnfSnIoEVy8yJlPI0D4DVyEgR/uc4QtC2iL:GxDnfSQboD4DIdiL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3640	msedge.exe
3640	msedge.exe
1392	identity_helper.exe
1392	identity_helper.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 4640	3640	msedge.exe	84
PID 3640 wrote to memory of 4640	3640	msedge.exe	84
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 4388	3640	msedge.exe	85
PID 3640 wrote to memory of 3788	3640	msedge.exe	86
PID 3640 wrote to memory of 3788	3640	msedge.exe	86
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87
PID 3640 wrote to memory of 3304	3640	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\505276ffbf6de691ddb5e72515540f6b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd504946f8,0x7ffd50494708,0x7ffd50494718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7216 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3734699305554940050,10866252204645677699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1332 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
MD5 e55832d7cd7e868a2c087c4c73678018
SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 2e0cde460a5b22c26da62a1447835fab9d61d6a211a6605b0df9161497c8c0ca
MD5 444df855171049879fa165ddbd5174dc
SHA1 a44f372f770a491012b5d0251959c5c7bf368d57
SHA512 08581b8c9be657500427dfbdc0360a71d214b7bdb8f44b763ae2d476fe877d79b9474c16c023cf60da48fd9f463d8a13d868a7d26ba5fcc20a276f1a2e60947a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 e45b87e035b6103ecd86f8e82eccbc25e4e0a4422e169a45f263a2e2a8a464c0
MD5 6ed3bacdbda6c639d34dca5bb804e836
SHA1 5b2359a5a7a78c5709088aa065f6990a93124a4e
SHA512 6fec68945b7871ec50fa96d3852a13f47b141f709b2477acfe507cf3132cc651a1bd21917c9791b72910f096e49bea3086788107e7e932acbacb037175d326a6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 4faf55c7c30ff7aaae8a995494b184570f09efea79b6f083ee63a92b2e6cae29
MD5 0f8a5749502a5aadaf6a99d1bf8efdfa
SHA1 f06900c21ac9cc90a349e7698b7322065c5df6a3
SHA512 cdae170f2f59da60921c086c6f6d47a2bc3c6fff5fbbf71798aaf4a8f7555d06f5dc280e0fa13a54061b6628f3bc69cbdd59870b6313b548f33e96c4f72ccc1f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 8b02be4ff0c85b61548becf700f1e0e48cac1989bb7e32d5a28692454ea43064
MD5 dc4453e1d470adfd880bfff29aaa2aac
SHA1 a15db7744b5f3a0974927d9d97c8415be99fb685
SHA512 3ad0ba8183a725f422b958879448711f55766a9b76d9d540fe0dcdf8e2e1a57b65a966c1496ec8324c5e605350cf14fcd8b99952900f8e2cfaf59f221acf5e62
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 c6122c3e78ad39c3469079c106cddfdb8cb6f29e2bccc27c7670abd5eed1ea07
MD5 6b00ba442939652e9de2eaf490fa35f6
SHA1 b3a46ac84576d8ebda6fd5012b87a33f84e5707c
SHA512 a441ff394af396bf0e234d7a3209ff711e795310a3b95f47cb2672d67930a09fd38d241010f695ecfa7855fa67cc05a16bb9fe2d39adbf8d26c4681769ee9439
SSDEEP 192:nbk/ZoUGWMBi+pNS1BvFz2MB+Hn3bfmVxb82jI2rg:nbCZIWDrIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 5968f30cc08545596a9c8161088c731a4c7131d0ebb585013e9e4a49ac1707d0
MD5 7590f5017184f940c51409324a9d6be5
SHA1 df32a5af9414f9a93732d866cb6d8d23ffab4236
SHA512 b2c0f3a2315aaeac3681837a96fe2c6c510d2e20e98aeb50d7596e5dd99adbee81384e2923a60694dea504ded13613174a33fd02c41796a5d26327f46ed7bc34
SSDEEP 192:nbkXZoUGWMBi+pNS1BvFz2MB+Hn3bfmb82bI2rV:nbmZIWDvIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 319c78611b959f4eb529dbbb1367b9d68f7c7f383c2e16cd67ae6346ce223001
MD5 9abb0f7e220c93652b31a30fb7783426
SHA1 31d8b7185e271654e5d7fcbbf7ccca3df6bfb1fc
SHA512 d7b8aa5d0e34bc0006717c86eaba4354ae54a0574a42cd1bf49133fa9391401d2e889c292cfa269bfc218000fd674dcab008c277546a975ab3baa4cb84a73d3d
SSDEEP 96:nbk+Uv1rYPfkwpvWMoiVmdeHycTI2UWQyV+VDCziEwb:nbklZYUGWMXbI2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a7544cad2950e2fcfbc4940458a3bc82440858cc5717619ecf7642fa4129ef17
MD5 57f3e3985524c75034b952fa6158474e
SHA1 d0a8d4c7ec4c0f199a4081c15dce8db2fd092a75
SHA512 77aa6a877c7e9b7c11816b15f85dd024e8ad59e2e2328b105c810cb29139f208d223cfb21b9ff53f3f2ce3b86600ae3fa87c9342362494b13b9fb97e5f732107
SSDEEP 192:nbkXZYUGWMBi+pNS1BvFz2CHn3bo2bI2rV:nbmZ4WD/IS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 7ee4461cea85dbe4f4181340f79609fdd45c11a7f379e24620ec2e44fdce391b
MD5 2db9a02e2aae575b318e924459703f91
SHA1 f397bc1889221ed6d55a0e71b02d2ae6b1d2e3cb
SHA512 d94534d3ea2618bb30bb8d6826157ab95b4fdc5b7dee7e97721bd8ef3863b3b1363d6df9a860e8e4f86dd063397c5f610fb587f33fb3b7d88bcaab04fed7e9f5
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe580088.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580088.TMP
Size 203B
SHA256 4ad6f5fa483020ef4661dad3a77092e5e5e1da2386b7b59610ed1040335d62ea
MD5 4b7285014b039ec603ad90c75d122fd8
SHA1 8566226f0cef2942c87bc69aac1aff072c3e5602
SHA512 92228b17c8449026596e042b93d0ef70b96ccb45233a30aee16bf65c80252990ea72f208016a417789d8d986bc9bf593eb04502a3b4db47827f33e0a6fa2fa87
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d0135b4db9cf56e413cebac109a0ed8961ffb9d9705c0b3ed3976368af2978ca
MD5 306c4a6445283b17a55809fff4e94cb4
SHA1 5014c0d7b17331c9d9de7df40c5912e9d051bd92
SHA512 c5668bc71e9d28215d917473af1b3d3aaf6b2f6508591d116eef34d299601664a4cf408b7ae4dc072c35e3124869d76df96d20340d7325997331ae9ecaa1289c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupIe2RUKp4zl91K3wVCxu:A9iIxuERzA83h09RZxYmklPKhxu
MD5 SHA1 SHA512 SSDEEP

Submit Download