e442f207796d36f994bdb94b475a20f78ca5d9ae8c120bb69016cca1c91b46db

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8467527fe5e0c8befd1b1534b4b8760d_JaffaCakes118.html
Size 536B
Sample240530-rc5yeaba6y
SHA256 e442f207796d36f994bdb94b475a20f78ca5d9ae8c120bb69016cca1c91b46db
MD5 8467527fe5e0c8befd1b1534b4b8760d
SHA1 fcc31ba5d9d246c1a05e638dc5f330fcfc6e446b
SHA512 579f29765bd0f66746f9ac86ee80eb6dc69f6c29e4f4adf58586ab86610695653f8e28bf5bb21becf05975b45f9d8a472ef1f97730c754b6b37343af0a009761
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
600	msedge.exe
600	msedge.exe
4544	identity_helper.exe
4544	identity_helper.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 1792	600	msedge.exe	82
PID 600 wrote to memory of 1792	600	msedge.exe	82
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 4348	600	msedge.exe	84
PID 600 wrote to memory of 2728	600	msedge.exe	85
PID 600 wrote to memory of 2728	600	msedge.exe	85
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86
PID 600 wrote to memory of 3320	600	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8467527fe5e0c8befd1b1534b4b8760d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffdc046f8,0x7ffffdc04708,0x7ffffdc04718
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3332 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12705820576313537273,741821108248422036,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 17d07e83d75e7b84899a717bbf4802a4b333cd37ae2827a5e75fa777da0e960b
MD5 94d88b45d2e85fd90e69510f0f186d29
SHA1 e2801b1ef1f0b814e686d38066412700c604f947
SHA512 a34f6583aa5d1bf463cf35138f5bba0de06f24490c92675c418dd85fb92b7a3cc847fa12355393327977feb225ebd7cccaa78a6ae4322f78dae613169a93f3c7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 335B
SHA256 dd1b55bd8cce06bc98a09b7ff2ba4d5a6f5f493e96504595531f2d529c9732d0
MD5 c98947c4622ac483024c07ce8f2af58b
SHA1 827e7fa86b8eec7c7e28ce8b70a671eed2f2f322
SHA512 f4d9809aee326b31302b630b69eb9809fcdbecf330cb3dc53294c376557a98c0af7a20da8416d3053bcc553bdecfbff9e0332db07de1f43c6e65f1f539192cd1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2aff9dc951cca20c60651fc3cb40551cb3c9bbe0847d10cfd2bb13f14fa6dcd4
MD5 85eb289fff17a8c74f4acb51d848714f
SHA1 3e4bc09190062b3d30d8fccc6ac82c6b557ddd1c
SHA512 12ab3bbd4cf56ef38ab385eda08b0ed7e24e628af89807ef593d292c123095ff5516f20fca725548b99cfee77ee2c68fd27952846ad3a7888f7226b282eefbb1
SSDEEP 96:nGkMF1g73wpvWMoiVmdeHplwtTacGUWQyV+VDCziEwb:nGkAejGWMXpKXGro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 36628c7f93ea13cae67f9dfe11500d0e9e65ccd987de6ce2fe2688a242c467aa
MD5 2d034198eddce5db4b91e6ed5c24c713
SHA1 036f1653d13b01e638b2b35f40fa6edeb011bfcb
SHA512 dafe2339130392f88e09d717af98645c02e5099f2050f8fe05c6a12ea9c567095776fba420cb7c7439a9d3b62f45791c5b0e2e9299d2a8d255abba757fb67c46
SSDEEP 96:nGk3F1U73wpvWMoiVmdeHplwtTacGUWQyV+VD7AiEwb:nGk1mjGWMXpKXGrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 41eec104795b0dac4b4551e6f574379ee3df4708e295cc44418635523b0624d4
MD5 31df6f369a6449e7fbf68847e0928b2c
SHA1 ec2f61bf307e87cb8c3daa0ed0e391f6a93eedfe
SHA512 eb4a34fa716872a380bd2d6c5f57ac5ac0317de5e6d982884b48d1096a9b651c78591e3a3dd7d0b752b3f800743ddf945ad0e343cb85361fb3b9c1716a5c5c75
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGme2RUJd/2Zyr3z2OMDCRJ:A9iIxuERzA83h09RZxYTOdGmaOMWRHq8
MD5 SHA1 SHA512 SSDEEP

Submit Download