8295b32b5129c22c34cb6514298240105a28aa55173ea62e04d97a28f46931c3

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4716f952b5e1580d7f60e64ebaf0ee4_JaffaCakes118.html
Size 137KB
Sample240613-jdj4bstckn
SHA256 8295b32b5129c22c34cb6514298240105a28aa55173ea62e04d97a28f46931c3
MD5 a4716f952b5e1580d7f60e64ebaf0ee4
SHA1 dc069605578845a68ec92618ddcd9d35d74dcf86
SHA512 69371cf1a03db32003c6fdbe7af2f8fbae8ddc507f18da59c85830cd7cf70574dcb1b659426476a9edaf17709c30ded118ee50967b50d9d20db02c3e16dd5c46
SSDEEP 3072:tT3IQz1uKecU/7NvO4ebe57hiZ7bYUeTbsPtQRqxmUqNbrZSZqC:C6z
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
42	sites.google.com
41	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2312	msedge.exe
2312	msedge.exe
3744	identity_helper.exe
3744	identity_helper.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1888	2312	msedge.exe	82
PID 2312 wrote to memory of 1888	2312	msedge.exe	82
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 1560	2312	msedge.exe	83
PID 2312 wrote to memory of 2056	2312	msedge.exe	84
PID 2312 wrote to memory of 2056	2312	msedge.exe	84
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85
PID 2312 wrote to memory of 3208	2312	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4716f952b5e1580d7f60e64ebaf0ee4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabdd646f8,0x7ffabdd64708,0x7ffabdd64718
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e75402656ccb392f3a374d60bc5cf66b27d6d5c678d64a5fefa087983181f321
MD5 317e13fa77aa3e3cfe8036e8e486c8b4
SHA1 421f228ba2ec46d2ba56361cb9964db0223a89c4
SHA512 cea4a07b0d6a5965829f4fffaea36e66a8e58d1d849e66321f3c23cc630d7c7c327741b8a700e89415d0c3311b9ddaa57068fe9d70d15557ad8e574736b41e3f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 742dcc8aacbd768a544eb59f8e019b7919cee551ec6551199ee39f1d33a5b12a
MD5 1577aeb8223b688aaf76e1498b380974
SHA1 2a0424c6d99cbbebd3926c2e0c197a4293064d63
SHA512 9c123e3eeebd8d790828aaa9bff2135104ddb92de21455dc89ef59a83ee89ab76ffbd1554f9364b36c5633bcf7e7390bf76466e6cd99bc6cd1f2a7544cb81fa9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d552211d679713145b00983430bb218b95e86c8cb93f10315a61b06845ead3a5
MD5 99366f6e426a29d84e8914d53d553300
SHA1 a6f0b4c5bc569d1aae91510ee85ad0385df99f5f
SHA512 6ef976a49b3a1927c6bf3be5e5e18a2ef8bc776f556b7f0f3ac0566dfbe6849008430c9023488857ac72e38f6e79460a1c3e26a5aba0c4e4ede650e12bdbad7c
SSDEEP 96:nrk/oxm/DQYmqM1zCmwpvWMoiVmdeH1DHtUWQyV+VDCziEwb:nrkBIrxCmGWMXltro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8d66b8523ba43d40a896b1011337c82aa62854e9d57b97bd4c9bc4773ace4b30
MD5 d22ece27aef364c926bd25e3d6d88e6f
SHA1 12bd926b8eb53932dd85eab3c554344b85d58ef4
SHA512 492105c95084154b05a333bab113324adf58f1fcbb6f2a003b44f10d2fcc90d243def910e327c48b1db3ea7d8466f81287c00fa153b59fbfa4651cbaaaa31e47
SSDEEP 96:nrk/oxm/DnmqM1zCmwpvWMoiVmdepIRGRyzjy7P21DHtUWQyV+VDCAiEwb:nrkB6rxCmGWMZIRGRyzjy7P2ltrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e4c9482cbd148fe49e10bacebe73afcf519126e31803d7ffc388d73b4726d54b
MD5 02b5eacb0b06229d154a7602bc3cce9d
SHA1 48213ac896345bdcfc9d3a1bab8d3b4e7cbbe1f8
SHA512 3035be9ad8f422f453ad144859b970dfe010e3a73ce30fb8ed1b68bf469706053928aa0633e1a29c613dd82b0fcc685e28a97de0dbeacbffbfa6ea700335c2a2
SSDEEP 96:nrk/oxm/DnmqM1zwmwpvWMoiVmdeV8IIRGRyzjy7P21DHtUWQyV+VD7AiEwb:nrkB6rxwmGWMF8IIRGRyzjy7P2ltrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 2b5b3a23f40b43ff76e25dbcba06567341f028dacfec38a3bbefdfa28e5d6b67
MD5 bd3a7820ad6b67e9fe2de9a9827f57f4
SHA1 9e71ab95e15beaee10dffe95a08169102ffbd74a
SHA512 f0269c40753770a353d3eeea824fb5f6602ae97eed0c53787f9d69665a2eafbdce14a7841c61869dca2441c68a1afc561495d11243f35072934742f98eb8034f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c505.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c505.TMP
Size 705B
SHA256 8b1da0988bc34e85d851130756e3382de46c9907ca9dd31a4f9185a8197ed328
MD5 a2c6c4a6db7c658a83f6e4d1e905dd34
SHA1 8f047a7949b4d38d38d096d8a703ee062259ad0a
SHA512 df6fbb2a371fd84abe5d82f0cdc260c261e5b5a705554a6fc4f7a2dd74ff5ac18fb1d36cce641c626a25bfbce1c5434ac33f3e5368866ad1bb4e42acfff57d13
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d61b89db28a7d33d35f78d44c75bbfd1d6dd0550f4e8c4ed2232ad8202b500df
MD5 9b63adaf5d944e06f10f75bd8aebbdab
SHA1 d77546ed8c0f5faaf958432b9f5d4d27baf2ccb1
SHA512 6659ee1c07a00061417913f98aab6b7ad49711304035bed19e2c4877178257db507da0ed17b9f73d38bff92eb590be6aed07916ab54e95dec13525845ce7ddef
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup69/e2RU0SRsQ3z2OMDCRHa:A9iIxuERzA83h09RZxYQHkGQaOMWRHql
MD5 SHA1 SHA512 SSDEEP

Submit Download