5a38f555364fa9bd3b750eeed985e97d25f6f1e1b375887f76a0ea9eea2fcedd

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1a5fa878d75d190b40a04e8c643b2ea_JaffaCakes118.html
Size 175KB
Sample240612-wnhpgathrd
SHA256 5a38f555364fa9bd3b750eeed985e97d25f6f1e1b375887f76a0ea9eea2fcedd
MD5 a1a5fa878d75d190b40a04e8c643b2ea
SHA1 633197a11a9cdeb208044e4e11653d01a987659c
SHA512 8ec573fd92f9d39d17c9dbf4c14220eb04b6721b4160884f1cc607e439618e14b2e7f5d9fca058b65c5c34ed6bfe630b7ea41390d179a2801fc30e9bedc89a74
SSDEEP 1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3dGNkFNFYfBCJiZW+aeTH+WK/Lf1/hpnV+:S9CT3d/FmBCJixB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
628	msedge.exe
628	msedge.exe
3628	identity_helper.exe
3628	identity_helper.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2756	628	msedge.exe	80
PID 628 wrote to memory of 2756	628	msedge.exe	80
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 3484	628	msedge.exe	81
PID 628 wrote to memory of 1276	628	msedge.exe	82
PID 628 wrote to memory of 1276	628	msedge.exe	82
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83
PID 628 wrote to memory of 3952	628	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1a5fa878d75d190b40a04e8c643b2ea_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe808046f8,0x7ffe80804708,0x7ffe80804718
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11618909911037460640,5898992411345217937,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 8e46c92fd974f6809c5b745c7086bb109ef7c6c27b9be6defa7bc0b3da690b4c
MD5 6bee08938ec83b6d9ec28a0c48854c2a
SHA1 81f38883d04d7e1af30de107d894e95254916d71
SHA512 ebc52270d7afca521006dfd2f2b9910d3cd852198879fde4ca20058a8f92454abdb80aad4e3b237f4fdeafd5d661c7f3f33bad12b94cf7798b319fc7c68e7c07
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 95e54716696eb88550cfcf14a3bab7d41d0db14efbf37b0f2468b137ed43f8c7
MD5 dd3412ad061198984a481dd22df06b57
SHA1 bbd1071ab1289b4e973d5e8602833c8a7cdab0a1
SHA512 531784fa131f4c455221ebb76152f33d3c7ad1468ae28e934fe8826089ec1d669b100b8b192579648b9e352fe641925d2a9a3cf6007cf2f21dbaf3b62dd2bd3a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 8b2e4292b19dedf01f5d1d241997a27fbc07b66875c6b1735a4bfe817e56429b
MD5 694c881ada5d14c8ba57a3bfaaac3ca8
SHA1 7eb95a0f0995c1f7c887dce78e89fe0ae17fd161
SHA512 bb17500c5b051aa73ac9a68c7d9f7d07a1070eefd2a06d2aba53024028af1d4f4d653d06d11846e0ab0d8de18870c21a36d1fc36dfe5e4c5d844eee11a0e6275
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d8476e950f84cf2f2d6af571916f59ab6d0f939ab6d58824fe389e925f7ebfb2
MD5 218569710df70dc9128fa0a68ae8a43e
SHA1 d9ec1bfeaf5472e2c5224c61171ea3c6c45706a7
SHA512 0dd275b8d6f548641d4919d181ccf18dfcdd8735fd439780ee9fd372adc49b7f6626c826dd425d86e49b333114eb68f19fd7e461624541231cf0810eacac8ead
SSDEEP 96:n4kVtP1/GwpvWMoiVmde5V/RJzEXQ3EraELlMk22WfuUWQyV+VD7AiEwb:n4k/9GGWMJZDYXQ3EraELlMk2erg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8a94fda432238e3ce6858096516ae71e1d99ce317a26cc188adcd87314c1abcd
MD5 cb9f2e1ef9fa8a116dba9294e0ae7b10
SHA1 bf80934a9f3da51f066d0d0b6ac22247c1101774
SHA512 87146f3c087ae87e92c12dafc772f822df89f85bddcfbad0b523592da880a2130242a1dc7283900fbb01027647d958888446809fd93ee0022958a389f5b0c587
SSDEEP 96:n4kVRP1/jwpvWMoiVmdeH2WfuUWQyV+VDCziEwb:n4kj9jGWMXero
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 43c18ab358bc4fc0714918c5eaafbd5d95b05ca063bc88fdee1b81c74a3dbe60
MD5 0d6e8eed181c6010a6c511e58958958f
SHA1 eaf995f609df0669482cde079584a40495b7a6d3
SHA512 41f23d18252bf2aa58b7b80133775982c39807ccc419d96e8623e4b66c45a69578a09b953fa4522221279c999f5a2cbcc643bebf54a458f9cdccb4a89883704f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUHfJe2RU0hh/7e3z2OMDCE:A9iIxuERzA83h09RZxYelz/7eaOMWRHy
MD5 SHA1 SHA512 SSDEEP

Submit Download