56de2f2fd8004fc9b8ed8f25258666179b042f1e33c13feed85cf558bd8d2cb3

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91cbfc47ebefb1d8d1deb820fda8b626_JaffaCakes118.html
Size 2KB
Sample240603-precwsfh23
SHA256 56de2f2fd8004fc9b8ed8f25258666179b042f1e33c13feed85cf558bd8d2cb3
MD5 91cbfc47ebefb1d8d1deb820fda8b626
SHA1 a91734be296a23d8e98e855cf82c2582755a3731
SHA512 827a28441ae49693b59f9cf12db7c0e4f4e26331ac31222d4df5df317de094c37b24f3c7cc07ed3fd4cf559f6b95e7aed4a2b1e16d9a2ff130f7084ccc56b394
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
2000	msedge.exe
2000	msedge.exe
1100	identity_helper.exe
1100	identity_helper.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3872	2000	msedge.exe	85
PID 2000 wrote to memory of 3872	2000	msedge.exe	85
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4588	2000	msedge.exe	86
PID 2000 wrote to memory of 4940	2000	msedge.exe	87
PID 2000 wrote to memory of 4940	2000	msedge.exe	87
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88
PID 2000 wrote to memory of 3704	2000	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91cbfc47ebefb1d8d1deb820fda8b626_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f8046f8,0x7ff80f804708,0x7ff80f804718
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6144200510817407446,4079497577135823995,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 309B
SHA256 9dc7ab04d6778a670307ef20635122877b2ac697312121839cb17d61709448cb
MD5 ae6c8ce48a605b0a11e57ceda68304b3
SHA1 25852d6bfa77c75b370cf5f9f5a2355a5b0f02d7
SHA512 e2c5624099797642ad47a7a284fede5a5898452e7ed58525defb1f24acdcf4b20de025cba22831e0b3bde05eddbc77de3642d68b8d44902d46e263ba18f90208
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 05eb0e3c55b00a6854ca50be7d41ebab04ed45849cd3d55fe81545fe0cdda137
MD5 5b6f32abad014537b9e1e6498020fa96
SHA1 570de9e8f3877c5a07bbd70162136ac7c5e84a83
SHA512 b445ed7b36d92bc65b40a1c51585c574b4ac65eef249aa43d411c2b64669027f3a37eee0c54f9ec6cfa165f8bc0409be914d44e7dd9992d2a1369776ae968a08
SSDEEP 96:nekfg1qGn2wpvWMoiVmdeHk4PUWQyV+VDCziEwb:nek4sGn2GWMXRro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 889e3686539bdde00342f427aad621c22ff97027d6a2ba637c1a5b053ca26d7e
MD5 f87a40f55a4c4a667eb24c157954c110
SHA1 fc51dbf35eec073ffebc554e385362ab773c7d3f
SHA512 cd75497efd3efc7c7abe6de477ad128b725ed0eae7ef86f024dd2fe434903b10cdc07b73ac204eee3db4561587b42955f175a8b939ede9776a6a0504eaa96b4b
SSDEEP 96:nekWg1qGX2wpvWMoiVmdeHk4PUWQyV+VD7AiEwb:nekzsGX2GWMXRrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d0c314156e3bca428b75403d546f2d527c58839855e574c4f71263867b48d706
MD5 ab7d46a6e1b903002be3f5070bb9d6ca
SHA1 f67291fa1ea36d3c549fb74bbb0ecc4c1600188e
SHA512 f40721ac69df9bbd19c40c3f14b12be3b191644f0b7c81aeb83c82b6a84b5aa2b45abfff098bb109040f7f87a82bd3ae05e03ba161ae875f5a79fbd41b1acf79
SSDEEP 96:nekWg1qeX2wpvWMoiVmdeHk4PUWQyV+VD7AiEwb:nekzseX2GWMXRrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 90d2cad72aef5dbb978fa4a2f5d000481a85c52f50808c295989959c13c28c99
MD5 3d5edc799896b581dd63e866ed8a44e5
SHA1 8316be3c7082eb2bcf6a80db9f211c82c8b74720
SHA512 89475061629aa741676758f89488bbd330da47cededb4f51337ee528df0b186e8550863f6ef981ba4e7d7fcf63e16d6b94dc7f695ebbfcbbe6741f7537622991
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1Eete2RUKy4VI3z2OMDCRA:A9iIxuERzA83h09RZxYv9IaOMWRHqlWe
MD5 SHA1 SHA512 SSDEEP

Submit Download