261df19640a1b15013a5c37c584dad38566ef5212ac46b9204f0730e9c0ca995

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
829f64bed380a96434e3fe64e63abd3f_JaffaCakes118.html
Size 175KB
Sample240530-bnf6esaa96
SHA256 261df19640a1b15013a5c37c584dad38566ef5212ac46b9204f0730e9c0ca995
MD5 829f64bed380a96434e3fe64e63abd3f
SHA1 42a0b8a6e8f5a27cffc68bb0225c458cf562aa8b
SHA512 9e9ff8973b7e70623e189c1706e51e12fcb83d13a30ac441faa9d5bff793036df8c98e4b2ec71f8821e97d4fd06e65659afbdb358f52f80f54345bdc6140419c
SSDEEP 1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3eGNkFaYfBCJiZL+aeTH+WK/Lf1/hpnVSV:S9CT3e/FbBCJiiB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
740	msedge.exe
740	msedge.exe
4976	identity_helper.exe
4976	identity_helper.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1440	740	msedge.exe	84
PID 740 wrote to memory of 1440	740	msedge.exe	84
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 2444	740	msedge.exe	85
PID 740 wrote to memory of 4412	740	msedge.exe	86
PID 740 wrote to memory of 4412	740	msedge.exe	86
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87
PID 740 wrote to memory of 4900	740	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\829f64bed380a96434e3fe64e63abd3f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4931152755718133455,14539819009404748006,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 c968f30c4096ac267fff0ecabf448e42ebce9d0218aa0bacc43b4d3fb507ed4e
MD5 57a6bf598bbc5462ba238e7ff9e7cac0
SHA1 a89017e190f8f808b4fc412a04951bf51f991df2
SHA512 5a5aa8e41a86b2ab18721b65b1276bedb41cecddda62e04ef15615376c7efe4866f874fc9cc60ec555db4e6e8a22293bd9ae1f5c549f32f8b007e8e2750f61dd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 01218e91bafc5f3760239e367db1a850cfca8899fa1260278fd837943512b789
MD5 e1cb22971d14db7a0a6c0a4b00c81d7a
SHA1 fae28e5646b46db3ae7c392e955a08f65541b5d3
SHA512 73009d35e17df7bdc215abe845adacbb45abf8bef2b856491868bb05e2db3a7a8f2a7f398a3b03dab1aae40de3156c4b49e73ce35367020ad2f452082e796495
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 9dca66dfb9e8ceee813efa7a1f16612814d241f4e0b1b4c655c8bd2190a15d43
MD5 2f48b620ab54a6f745e8b6a884546008
SHA1 f69ca3b7a645a6f08b9e9356c5a26993c947bc60
SHA512 7d9c7d90dc34e62feaedc4563429c75200d7c708824e30f2dcc2d88912387b4e7ebc30adc88b101cad4501e64cedcf0e7d2829d747d409fe7952b6f8b373aaca
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b9f415f87eecc930c13a036db4a177ffa65a32fb5926d9d3289345d8ce10a04e
MD5 acf0f463f354cb23b4e8964083b29f87
SHA1 b4a2c642a09e158edeb3818cc74ea434a61aa83a
SHA512 925e037cba171e8e130a63c24749a866025b25f8c4191d590e619554cc166f3a85bead553c9c7f8038086ea401e04f62e226cce942f9e84e0a716f683d20f39d
SSDEEP 96:nmkfa1Ctn2wpvWMoiVmdeHk43w2UWQyV+VDCziEwb:nmkSEn2GWMXpw2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ea934118011dae235d5a72a4241a6de9a7367584fbb7d87aff9fc4c7ff888f6a
MD5 457723be561dea3155d44174d84e26b4
SHA1 8fd6f324bd78926840152b9f97d8b58120213b36
SHA512 be4bb4b4ff200afc0f16e6f497562a3be79aabc732451cde6e6746a5646b7e632d5a4c5841e309d803ef16859c16485c4e0daa528b8fdc02f6dce4c602d9e543
SSDEEP 96:nmkWa1Ctu2wpvWMoiVmdemVtRUzExE0gErVEKa+S2k43w2UWQyV+VD7AiEwb:nmk5Eu2GWM2raYxElErVEKa+S2pw2rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1243e94654d672d0f854b98e9aea3e236a5c612b2215a946f6dc213e72826f5d
MD5 59654a09e196178e05e4e2275a8ba4b9
SHA1 5e98b7d83cddb4447eedf894befedca3b613680e
SHA512 e54d717c92cb5dd9469ae6d401928555e4f1620ec55dd187b386f1cf1b336371e623e1fce45dfb60dbfaa4762fb7b86a5d6374cfd3345f360c969f66142827bb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXeXge2RUUqy4Vb53z2OMDL:A9iIxuERzA83h09RZxYOX+5Eb5aOMWRw
MD5 SHA1 SHA512 SSDEEP

Submit Download