80b8c4e6ba0711bf498be3e9bf0298e1fe23f9efbae41c5ef089b1a3aae0a5d5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a34a82665b7518deabfafa28af7f9d53_JaffaCakes118.html
Size 93KB
Sample240613-bflqyaybrd
SHA256 80b8c4e6ba0711bf498be3e9bf0298e1fe23f9efbae41c5ef089b1a3aae0a5d5
MD5 a34a82665b7518deabfafa28af7f9d53
SHA1 6acda1d5d63b2c6a3faaad0fa6d6c728c1b364b6
SHA512 8010f76024328cdd6940c8dc481c7a546cb1da33d65f29e48c5611b383b2662482b498ce4ac5e7074b22cc2bdc6dc1a1d83c09d53c965dd12dbf7b3f70c7441f
SSDEEP 1536:zv/r0yMBgsRkayQu2GtOgTA7jwdCyRda6DAdpVh2HdZasNl5oBZyC1akHwNZHYRw:z70yMCsRkayFDh2kdCyRda6DAdppRX8b
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
3884	msedge.exe
3884	msedge.exe
4052	identity_helper.exe
4052	identity_helper.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 4108	3884	msedge.exe	81
PID 3884 wrote to memory of 4108	3884	msedge.exe	81
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 3544	3884	msedge.exe	82
PID 3884 wrote to memory of 652	3884	msedge.exe	83
PID 3884 wrote to memory of 652	3884	msedge.exe	83
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84
PID 3884 wrote to memory of 4836	3884	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a34a82665b7518deabfafa28af7f9d53_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff928b546f8,0x7ff928b54708,0x7ff928b54718
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2648 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15258831488678959580,5479070559187052461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 29b47cb0fa854fe6cf24eef096414ba6cb9d80dc2ee91f561953e6ad096d8d29
MD5 5ccfe00b0fc9328f9c933f05221dfc49
SHA1 33e2cca404b4c3687e6874315c39d3c55094c283
SHA512 c4e9ab9fb39e897f857703dc78172fdd5859aecfe35019fb7f85f9d180b1e5f36470208e08f0f0bf4cabca4a32977ea63148d5c12799b7bae3344ce012b26878
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 8a16e292f69856e2b1105c630df853903116b42eb1eaab2d48ed263ea6609e5a
MD5 3d39a5607e84aeff0325f2f325c11d8b
SHA1 85b52e68a0dbe24a81a113feaa5f841652d1c5ac
SHA512 53d49846f753b7a6f391a6413c1e3a2d7e9de036cac6e7bb992add738d7e6decca135eac022390a561c4102acaca7b023c8429a0f4eb1baa8db749baf4c3cff1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 502bdef8b9785db4c4d90a537956eabaa44e8a5ef0fa9b07a4ff1bd82d062775
MD5 fd834ffebdeb011a60dd54390b01c531
SHA1 8c1173f9d38d657c9b7cff89f404386462beac69
SHA512 08202154dbb6f8cbe098b10a011ac87b1bd9552748416b5e1fa3b1478d792c5faee0347c1ac74f0d76c8419bdabb21bf02ace6c751e24fabecc9e152992b6ff2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c8261156e8d9d1853ff665be6acfee72aa0475ca2fe7cf14a3dda1f3208b8739
MD5 c7bebbc89ffd0b39fccf7e585e085c0a
SHA1 97860f7775dcfe412b305d86034dbd802beebaa2
SHA512 ad8c53946b02fbd17240b32ad0a93eb94c2c91487cfefccebf627eb0114146bcfd0890124b49cd3f65ef86ffbbd732d4b8675fab2bdeb6c922d55aac69b658ae
SSDEEP 96:nwkfoxm/DQYmqvQ1+JapmwpvWMoiVmdeH1Dt+UWQyV+VDCziEwb:nwkhIToJapmGWMXv+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 49d8719a74e4a351a2fbf62e1087e28bf304f82ef749c69a4b4ebd954b8a42e8
MD5 0198d8931098e7a2914a6160052359ba
SHA1 0397d855287ed7eb31f05b752c906edd29c74b05
SHA512 46b9c116ef9db55e795617984503e9284c87d0fcfed1cec19065efcff39887125fae26c69e67cd3c2c9336b6c7502d4b439b9ba4d538531b7ed31b0f6f1611b9
SSDEEP 96:nwkfoxm/DnmqvQ1+JapmwpvWMoiVmdeH1Dt+UWQyV+VDCAiEwb:nwkh6ToJapmGWMXv+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 88658b66a82fadc6c8797939609af6d677068d83828e090b96649b4d96087edf
MD5 97d5afade9b7294ba7bfb86bf070d2dc
SHA1 fd6ad02711e0d90a69478482955fc97e1fccc4a5
SHA512 f9f30f23ce2788a5d5ea0b29d59c253856d8d3c493ab2fe8a271ff9d92e3fa494a07a0125a025ab83e2dc2c6a3cb46984a2f5dcf384a7de6e898d26dfab387f2
SSDEEP 96:nwkfoxm/DnmqvQ1+JabmwpvWMoiVmdeZe21Dt+UWQyV+VD7AiEwb:nwkh6ToJabmGWMpe2v+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 437f0b7e607c27a37b9d1603b606af3fadd512e37ffd70c1ec86a48e1f99f009
MD5 155a3b3a3dc315400146635d5929f47c
SHA1 fb62bd5b22a0d343f372ee26c4becb66a3b8c854
SHA512 445887ec67627383c891fd5f6355d225559882ea484c53ccec63c3eade2982b097a9e78e62e77293e2876d6d1a84835f0711ff45e43e1b97f3434cd7f931abfd
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphjebf2+e2RU07SRsQ3z2O2:A9iIxuERzA83h09RZxYhS7YGQaOMWRH4
MD5 SHA1 SHA512 SSDEEP

Submit Download