aa133aa8c21512fc18ee723d51fef4d1d487a0ebba8b9e979daabd2332869c18

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00349ba449a9c8262f0c97571c747153_JaffaCakes118.html
Size 46KB
Sample240426-hfbpasah81
SHA256 aa133aa8c21512fc18ee723d51fef4d1d487a0ebba8b9e979daabd2332869c18
MD5 00349ba449a9c8262f0c97571c747153
SHA1 ade68943bbc279f0decc4dc9bb6b70637ffdb7a6
SHA512 b013539719874236d76ea06d86e0db2ba732326b477dbaf500f9d1d1d2281adc57c4443fb5b65b3579d86c87e07db60f8c0ad16abbb2451b6863440a794c9151
SSDEEP 768:9FXbE1boB2b2vbPGnSz/u9blylWrV+oGez01JT4JMYAX2VYwGP:9FXKMB2STGnSzcxylWrV+Rj9ZGKLP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
452	msedge.exe
452	msedge.exe
552	identity_helper.exe
552	identity_helper.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 1300	452	msedge.exe	84
PID 452 wrote to memory of 1300	452	msedge.exe	84
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4060	452	msedge.exe	85
PID 452 wrote to memory of 4392	452	msedge.exe	86
PID 452 wrote to memory of 4392	452	msedge.exe	86
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87
PID 452 wrote to memory of 3364	452	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\00349ba449a9c8262f0c97571c747153_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd06c46f8,0x7ffdd06c4708,0x7ffdd06c4718
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1055830602333365176,12648898592999067970,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0
MD5 120a75f233314ba1fe34e9d6c09f30b9
SHA1 a9f92f2d3f111eaadd9bcf8fceb3c9553753539c
SHA512 3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041
MD5 bc2edd0741d97ae237e9f00bf3244144
SHA1 7c1e5d324f5c7137a3c4ec85146659f026c11782
SHA512 00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 be639af1fe3be0b514aa2119b1243f7883ff0f957b9f981ee9527fb60035ada2
MD5 b57b9eeea886bf3a2326875719cc56bc
SHA1 ca3969bc5f1f20e4ba45781369b960ce8a64a8a8
SHA512 cc9a412dc141256aea3c3df2b27db31dfdf1d72755fccbfc8f9e0b5f20fa7ef537fb201729bd3d71bcd698835d5630450c67d56bad6bbf6d82ee0796668607fe
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 b656b8aba683b419764e2276db713fbfef6ded7ae1969d931c20974f3724c8bd
MD5 cb9ac8540eb1a9ad350bef7bb3ec8aff
SHA1 7cf58280980b753e5f5051c00d376cacee6eecd6
SHA512 d60e47572db5e0102bf682971be80fcd671109c28877fac356e85a45e65b9b8e4564635ca34e29d1e303ddeaa4bc2641269e6ea9432ab353d191f44676ad9479
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 986B
SHA256 035b44a2e32fdf6062e35e7f48dcafced8a4d944442b9cbee90c3513c490ff75
MD5 b4769a2a8d97680d9ef53cb2a7184f8b
SHA1 041e7003e70fe57fcd386121fed237664dcad7b6
SHA512 d311b8837f774d750efaff2140b4ad5eb7c1fde928b1b3104b56cb7db61ccd9672b1949b83911e140af328ffc0e4be8166518e3fb12c92217dbe5f9c486370c0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4559a189542286de1db78c89fe5a7c2cd77ed962441631d9ac0dac0e3e016557
MD5 2a7c12ff1c9cbed73b3f6281e45d6174
SHA1 a61d43095c352911174bc60fbdcf8b98a5b3463e
SHA512 cbf230cb44987a7dd6b72b1a77b1dd7f6d79f0d7ff191da80a6c87bc230a878e941c3b602534d8764995bad5b28f3e61c21bb599b8908d3b9eb4b83d0056bacb
SSDEEP 96:nVk2Osw1iZwpvWMoiVmdeHwJcUWQyV+VDCziEwb:nVk2AkZGWMXhro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 52674ce740d61e4f87ce7ba091b199c1721ad8fd6edd70c103267bac461e4d44
MD5 c2cf1095d891584acf758b32cf27ff4b
SHA1 f3175d76d898d4f97dbb0ffaea83496a450af025
SHA512 328102e7457cadc2ca19a6c703c59274e9e88235060a36508abebe83fe2a2d4be0bb99f8fc15d840818fc0551b1b779d1c051a5e43793f7a5d23b338ba16bc44
SSDEEP 96:nVk2Fsw1iYwpvWMoiVmde9rhl2wJcUWQyV+VD7AiEwb:nVk2dkYGWMNrhl2hrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

b6a1827e-f62d-4ab7-bf23-ce578fdb9144.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6a1827e-f62d-4ab7-bf23-ce578fdb9144.tmp
Size 6KB
SHA256 29e1dd3401726f4085219f4ffa83409c948e526fa44152405012f8954dc4d1c7
MD5 69d592c3f2dabd8dd432fc010540f89c
SHA1 bc82f2e02a3a2891b58e74abcb614662994cfe6b
SHA512 9f995f4afb312f56d17d2547530fb47b1f62a2bcab895c4630ca0e5cc397146b34318ff02d469e55bdea9ba004e27eec4c36bd573a82289e220a16cc21102297
SSDEEP 96:nVk2Fsw1iYwpvWMoiVmde9rhl2w/cUWQyV+VD7AiEwb:nVk2dgYGWMNrhl27rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 38ed2e809778914ac0f5bcc74617df62bdfdbdfa3a015f9ac248493579ec2165
MD5 e5884ed34b02cd56e8f715701438c832
SHA1 92e9b6499d8ed3a33afab496431d36611c21fb19
SHA512 5e97aad94a1c84811b920763add3416a2f79f34572fffde477079687d2bd58abde6e2f08a35252a79d3546cadc88828cb9fab903968cda07e4db7ecc17c4ca1b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCe2RUo32Fpo88dylluDfB:A9iIxuERzA83h09RZxY8cFpo8aPTB
MD5 SHA1 SHA512 SSDEEP

Submit Download