4535f688cf0ad68da7a4cca99ea533d2168b2f8e22b97bce672c453237e6ef4a

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70514ef408063f7d43c510bd565f4c21_JaffaCakes118.html
Size 50KB
Sample240525-a2d3jsgh22
SHA256 4535f688cf0ad68da7a4cca99ea533d2168b2f8e22b97bce672c453237e6ef4a
MD5 70514ef408063f7d43c510bd565f4c21
SHA1 c40eee31967d5c43976782b4f85ae5f43f665480
SHA512 5d2937ef8ee261fa9693bb153b20cc304e745df3c729e0ff6b9ade15d59d609a281af1f194084dc9b51e9f45c1bc8dd84bb8c5b672da20bf0a362e7d4db8d421
SSDEEP 1536:EpkADkAZckABKQcZkAXhTcr0rGPGNMxZPdJXxPzQakA7ivFS3XBbPWpBoYlhntJh:KkADkAikAITZkARTcr0r8GNMxZPdJXxU
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	sites.google.com
32	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
2428	msedge.exe
2428	msedge.exe
4444	identity_helper.exe
4444	identity_helper.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4508	2428	msedge.exe	83
PID 2428 wrote to memory of 4508	2428	msedge.exe	83
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 1416	2428	msedge.exe	84
PID 2428 wrote to memory of 5056	2428	msedge.exe	85
PID 2428 wrote to memory of 5056	2428	msedge.exe	85
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86
PID 2428 wrote to memory of 3256	2428	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\70514ef408063f7d43c510bd565f4c21_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9053046f8,0x7ff905304708,0x7ff905304718
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8488437000105566057,14005258984005419431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 74f55a45323a97ff85042074886c58f532c26b398554c8ca01dd73a6f9a45603
MD5 d8e98c986a307dbbd3964c661decb7ff
SHA1 d1bfda078b9e979cfc962c76ac760643aa62bc3e
SHA512 5e8767f4dc2df315b725c2a87265553ab14e2d2b8f5d940ffcbb1f95c9d570d0ba494ab9d94f7741bae36ee0543016353377709eced06ce37cdc894f657bf173
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 d8dc5c95bbaa2b27ff42dd19086980f9e5d892783a4cba7577e25a0a24d3d1ba
MD5 ad4f4d09b3d1f67e1b9f2699ac1d5381
SHA1 709dcf1c0fd0f898d8fd4035efa8226983a5814a
SHA512 eb54d312043c5888dc42da7be8375f3f8aab679062c57b8b07f0d331780bdcc676509f054794ef2e1b92067e7bf8d07604746cd35331d5be592d031fffe5f727
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 3762393b3b227506456341803ac8f3a6529c0a5b1c317c8ae128eed96c252256
MD5 a26fa137671c10f261444f4c2c36e5fb
SHA1 03dd3e571534954ba1e983c1c92126f5c24eb4f6
SHA512 8dafa803da268f9a4c3a30ce52b67658512a7c010ae27c89dc3d3b8ef02ed9de266e0371f862c4ba7c2574142131ad12456f6100f40e39e398e3b99b33a8b542
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 017bc906c6d40ce6b6d6de1c6d4a1cec8125a265531d0a9b0487ff0b0a94edb1
MD5 9cc5eda49bd3e9b2c6242dd2a57a2a63
SHA1 768eaebc57ce2d33c8c4745e24a4fc722b1d8919
SHA512 a4b30e394270639a5fb92537716644d807b047faf28ddcd68ac26e059f58b7e684a5c0b3495eb21aa9734d78b4fa355912582505f2759003a927415cbfa175ff
SSDEEP 96:n7kuCd1VEjuwpvWMoiVmdeHvSSa+UWQyV+VDCziEwb:n7kTPEjuGWMXI+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 abd45f96632d60eac17d991990b15f76227be2466e4f3b046fdef7e29e78867f
MD5 cb0f34c68119540cbe1151a60375cba6
SHA1 cfa0d88d7b59af70ebc7b17532117929f6e55d7a
SHA512 055533b4834c71cdc4d3a29bb707b43c64edd9be82c2192531ade84ad211a515cb67024f0a10ca82083d851715820743e71b0ee6dc95f591bbe6362f833792e7
SSDEEP 96:n7kSCd192juwpvWMoiVmdeYafg3v6n6atHs92vSea+UWQyV+VD7AiEwb:n7knj2juGWMIafg3v6nttHs92w+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e387d5e2903ee8fb4e36cbdba674ded52b95af58d55658c2f0a56d5f56425ec7
MD5 a342388306e406f775659373911303ad
SHA1 5acf35d3ad394a09ae5934c0982f64be98eaaa13
SHA512 fe4c52fa9751eb1037fe02b0a51e1d56de8a9acbbf5a5f923160bb1ff7076b9bb25293e7b0c254c8952cb5070fe1690a1cfd0edc40976f4b7194e02434b45db3
SSDEEP 96:n7klCd1V2juwpvWMoiVmdeYafg3v6n6atHs92vSSa+UWQyV+VDCAiEwb:n7kOP2juGWMIafg3v6nttHs92I+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 42e9603bef770e32fab46b10fb86474636e15a4192036e2927ccf3363808468a
MD5 e9e91e246d06441ab23afcc6b7fcae81
SHA1 3def5b8127f0be3207818381a2a4e92a2c7facd1
SHA512 c973056a9e79362cfacec91f6d65e68a3c8e13d255985ee4738d2ecb460727f2f9b7882cb2d1863a1aed0f97a8333640cf1be54a96fcff9c6b92c7066072190d
SSDEEP 96:n7kSCd1V2juwpvWMoiVmdeYafg3v6n6atHs92vSSa+UWQyV+VD7AiEwb:n7knP2juGWMIafg3v6nttHs92I+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 44423c3c80c85557a71dbb5c611cc745a33e0ddd3f8d151cb96e6c2169ab65ba
MD5 04b2700e70bad04a165dda02774661dd
SHA1 76ccba61d74ffb82b3e7e62288f7f86239ecd69d
SHA512 b04f8e571695864945fb85f48d866d976c8c80189d2853883e59e56c1d852495437abf61cdb57d36f26d973ae9938440f529b709cd3e814d6760cfe3281512c6
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe582863.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582863.TMP
Size 538B
SHA256 715f71a7432a6db438cd2b38551e943f5f59d10342805c6d7c562356fd712996
MD5 22e56342ff86fdcabec98305a0364040
SHA1 49e7f7740857a5cfc8fdde3b489491c8f9f74890
SHA512 3ae392795f297c279989114955ad0414eff8f88600c74961bffef7c5cb850e4be9f2f71f17ec1e2bd25cbe80926d61aeeead9a64f0d5b3fcf630a0b9665c542f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fd7e1cb5af8b96e90f02ce6b8e7cb8e7741cb00261102e4e850fce4c3ef8b108
MD5 51dfa693103c9d42adbb992073f8083f
SHA1 e1f48e12ac961a4b3f27c2fbda6f02e9e1e0c45f
SHA512 160f3711931d5efa4dad65472bdd5d866115166ef4aaeb382eb18fe32bc6a89ebf798dea8a1cb8d5d97fb3f69f4bd778c2116df8488b8a1ed3a618599bb1714e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupM6Ge2RUeRuK3z2OMDCRHqg:A9iIxuERzA83h09RZxYM6I8KaOMWRHqg
MD5 SHA1 SHA512 SSDEEP

Submit Download