d102b1f00847dc4b6b4d20887dc15046dfd36ffa06c5fef6cd31fbf3ad937b96

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2b82bf466ec150abb9713aecd2867ae_JaffaCakes118.html
Size 86KB
Sample240612-2g2fwsxark
SHA256 d102b1f00847dc4b6b4d20887dc15046dfd36ffa06c5fef6cd31fbf3ad937b96
MD5 a2b82bf466ec150abb9713aecd2867ae
SHA1 fd1101231d52289b83134bde7481eddbe4d3ae6b
SHA512 eaea3d8d803da24fdef58a403ab4e7a61e0846ff97feccde4bd0ef381381339f4223d9765174e7854067f64ca0c87415ad832e2b98611e3ca6d3c00e9ea70bf7
SSDEEP 1536:f5EoKkeeMe8eIesKeleUeueueweeeMedeeMe+eIeqe+e/eeeCeNDeieedXOjwL5A:Rbb+MEy9WTdsxp5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
3508	msedge.exe
3508	msedge.exe
3204	identity_helper.exe
3204	identity_helper.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 2412	3508	msedge.exe	83
PID 3508 wrote to memory of 2412	3508	msedge.exe	83
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2712	3508	msedge.exe	84
PID 3508 wrote to memory of 2156	3508	msedge.exe	85
PID 3508 wrote to memory of 2156	3508	msedge.exe	85
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86
PID 3508 wrote to memory of 3172	3508	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2b82bf466ec150abb9713aecd2867ae_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd66c246f8,0x7ffd66c24708,0x7ffd66c24718
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1305292912025270909,12729596719410140011,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 54d760e844bdfa7e8adbeeb808423c4abab15f79c3102e54a9e76fff48dc0951
MD5 63e29ad8c6a59c2b5aff09d9a64cec0b
SHA1 a1820e63c5ebdb67664b05e09d2e58f5912cf2c6
SHA512 3c1850cbb93fc472762f6ca36a0a805181026631515727f2b9a9be63fe1b67d37208c5c5410f1157545df001195590176dc7653286dd896e64ab777978f4d901
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 67902daa124d2ddb9a33df37da82374de14044866a6ad6204deebd26d4da87e4
MD5 2f0fca5c76ec0bd5bc0d772ad9dfcc3f
SHA1 6510dfda439ad17d9c663c8e504a47294918ef02
SHA512 351c65a1988f75cce36192010b94e09a6a03a1563eb44bae7a10b948f722e04b82e0f60488419105d15aaf5b5117adc64d9bb8be343ef7353f30dd91fc90ef82
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fd5c0a741b07c0f2a16e35683d963c372adc845916aae60fd0c38e6e5332daed
MD5 5bb24174f1104c04d4d990a28c4a7724
SHA1 201409a0f7ff48ac31a803d9a850f24fe1d6136d
SHA512 a41e9a3ce1e1ec9bcb0846ed26d8f8fdbb7a849a0fa2627de4b5d388c66cb50ea928679f19cf2df2c475600ef9ec3a9bc5aa5be453d00eec5afd668e83674036
SSDEEP 96:nBkBRE172/cwpvWMoiVmdeHIqQK5lKUWQyV+VDCziEwb:nBksBgcGWMXd35lKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 126268723b293b16b4cf866744ad044bfeefd51c0475e6b51a7c368a3be275de
MD5 2c5023d7438a47da28492110860e6963
SHA1 3cc81e6623731a0fe08d0f88d4041363a30dfd3b
SHA512 726c5d0b444085ba57800174f3164b2d9d7c8a404a2420a26ee7952e797e170adf46e11f2ec7d00546e24e4f4690e324420c564498fea1e628c1c46ef02ca5e1
SSDEEP 96:nBkBxE172/TgwpvWMoiVmdeNcoqI2IqQK5lKUWQyV+VD7AiEwb:nBkIBgTgGWMdcoqI2d35lKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e0a8f3bf7f263582edb6a0715414ebeceb7972486dc2903c2ec35a8851a8beed
MD5 2451d6a8c1d8dfcd5c1b7521042ed755
SHA1 016efe695ca523715dac4e56841122a3ea962210
SHA512 46117c092c3b5eac59d6e685506d851eccaf28580cca94bfbf7d8e10d42b820f8f26b1e90a20ff36af3db2aea81c6a55497b28cfd953b91c733f7ee419d38618
SSDEEP 96:nBkBtE172/TgwpvWMoiVmdeNcoqI2IqQK5lKUWQyV+VDCAiEwb:nBkoBgTgGWMdcoqI2d35lKrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 46237329566302d4b8d27a940fbf5be82cd11a643b7731db1e489b9b6c77121c
MD5 e021498be96058b91f68392bcc4ac96d
SHA1 7067959f68c328a529e00d509bbbbacf0d885c18
SHA512 94d1a51ab55ba64d7009b75683652dae43510843c907831d2b47c35e056fae314931b7fa2a93edfb7d52ea529eecca524f013d4b3651d5c7d2bf7e0abdb032ea
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupq1p0Te2RUFEdvau3z2OMDr:A9iIxuERzA83h09RZxY1DZHaOMWRHqll
MD5 SHA1 SHA512 SSDEEP

Submit Download