e46545224e1f891f7234b6972040bde47c6b0bc8f17872f24d461e90ef37f363

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a555b7867c2038f14101b41fbdef7ce3_JaffaCakes118.html
Size 9KB
Sample240613-nrat2axanf
SHA256 e46545224e1f891f7234b6972040bde47c6b0bc8f17872f24d461e90ef37f363
MD5 a555b7867c2038f14101b41fbdef7ce3
SHA1 db3c98b6a9e7966bb38e4b91e796174cf8e23273
SHA512 71064ee744f3eb9f9bc831ca2eea7daf3ad3944c0d1950c6d66b86e44ed209ee9153cee5c5e709b7b73347132fbd1a430a0d1da55dfd3f5a3d40633dd6fc7bb4
SSDEEP 192:cvZUeRd+hjlTzyA/JUlj7YOgmuRd+iE7RD5NI:+H2YVloHHINI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
5016	msedge.exe
5016	msedge.exe
4080	identity_helper.exe
4080	identity_helper.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3684	5016	msedge.exe	81
PID 5016 wrote to memory of 3684	5016	msedge.exe	81
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 1760	5016	msedge.exe	82
PID 5016 wrote to memory of 4128	5016	msedge.exe	83
PID 5016 wrote to memory of 4128	5016	msedge.exe	83
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84
PID 5016 wrote to memory of 2284	5016	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a555b7867c2038f14101b41fbdef7ce3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe706746f8,0x7ffe70674708,0x7ffe70674718
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6184283965359206657,4342018931212700354,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3d9d2211f82fb405530387f763c33b715236bcd14ba97e72f304164858b0bf4c
MD5 7f4d9dc93d59f60c861ecfb953661f23
SHA1 b39eafed63c07a0da659a6190fcd43a8f081d189
SHA512 68d9dea1482967ebc91f0bc31cd3396f98afc4a380b5a00f3769f84d1d997222088feac914770d0acbd3fc6ee474eb522992b39969d48cc4723d275410c0ce35
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 fbbc1a5036255bd7c3de40383542667104e155430de94d18b043e59d12f8cd0e
MD5 cb62faf46b74f5fc4431a63157d5c656
SHA1 ab20e075b13f113cfaffa0e03cd4fcbeba9dd3e0
SHA512 8cc7e47f25607df03d7dba10157d3e6ada34f5bb26ce365b026b0c520e1412a8012e93eed7cd8244c927f34d51573a959c919deb3d34e871132a83c25f8a5710
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 727B
SHA256 7e874adf3f14250e244af930b45a94da07a1759e42fee2381ea3d53a17b20625
MD5 2df63dba8354b7d090a26ec7b03b4338
SHA1 d3b757635496b29d37a3578a90ad370318d9d77b
SHA512 1ec4a127d99cae03856e505a0e55796c32f222a8c163dfd7eef0b19d23b9fde92abc50d32068cc35ce46c8d26b31bce9010b4bcaa0f792053d113b2078147def
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 696B
SHA256 e056cff4941102f78c5a6aef9bb8895f3173595f3c0d56c494aca931c5bc3146
MD5 c81b10a2d6435ca65fd66b47754b6681
SHA1 e340ce8d01027f36b802cf5a6b6826be16b69fe1
SHA512 2b8cde1090f14eb626a3c7e67f8534e6c270716f9740468d825831afbea5edd61338c018d251152b6cd51cb162d1f92c3a944cb5f42f6b065e76d73bf18b1fec
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9bcc46dcb6d1761a5f27ec864cd751506ce8ba0f5a62f6e1671982fbe7d18ea7
MD5 d8ef19c190c19080e6954a6233c29210
SHA1 f29b803fa2d868013a7ae898e7fc8a953c0e15e5
SHA512 0a25596a8d27dc140afecb1b835376dcbd3a0c3bcd263a1776e1ce7538703cee6d776eaa84cca67d0a1d4bdd0cfabed056cdd2f93bc3152c6a5e314670794e3b
SSDEEP 96:nwAkVoxm/DQYmqAj1HYwpvWMoiVmdeHIqQV2tbUWQyV+VDCziEwb:nwAkfIBjBYGWMXdc2tbro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 264b4d7ab33b6f5f3729e422fd6e7ed9246b8ea54ee5ce98b26bf5759eeb15ad
MD5 e96683e2ffac0d148101f0bda38f1fe6
SHA1 2ccaf584b8f2dd8df9112b224fe5d39a7fd42e0b
SHA512 1f148654228f02add2eb4842fac651e3a614b071ac6a53b688065a1bc8f92d51b08fdea8aec28c8ef246118ce02b71b3fb639b4e423749c51de1e4441e82a51e
SSDEEP 96:nwAkVoxm/DnmqAj1HowpvWMoiVmdeMEiyi2IqQV2tbUWQyV+VDCAiEwb:nwAkf6BjBoGWM8Eiyi2dc2tbrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 320cea1b86da2465ee5a16835c66d883f110bd7c8935e75b779ceadf07c3079e
MD5 52be5a05550a50f1c8aec4fc7e0b957f
SHA1 1ca187f8e888a27d42699465b368c6774a41e11c
SHA512 513c27adda81aad59350ed906b4936be5d2ffc05bfcfabae7667154e50648461f74f62885caa2e9ede5b3863cbcc15f24ddce5ce0db8acf49fea00209bea9ef5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupA5p0J4e2RUmKwdvRa3z2OC:A9iIxuERzA83h09RZxYAsJ2jKIRaaOML
MD5 SHA1 SHA512 SSDEEP

Submit Download