a24b6ab8163bfc95dd9c1cd16fad861115bc3454ec320678a12301b9eb7b04b3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3cb858fc123036a322e8898b03bc13f_JaffaCakes118.html
Size 81KB
Sample240613-et5mratflf
SHA256 a24b6ab8163bfc95dd9c1cd16fad861115bc3454ec320678a12301b9eb7b04b3
MD5 a3cb858fc123036a322e8898b03bc13f
SHA1 b3b8076ea3b05fbda43cf77ed28389bfd02b5942
SHA512 2188ba37c3342593dc26f45c9baa3984277e2ae817dd749a68d24ceac5dc7b83694f16c9b304fb0e961d02e7b35739446fe72006aba34e3ab4585e1ed52c80f6
SSDEEP 1536:NXfqsr/DjnXXN1VubY3GxI7kRqu0D1uxj+Yr2kxA/KzooNHdDPdJ3TCi1fyL0gaO:Nhv7kRqlD1uxj+QZzoMHdjdJ3J1KL0gZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
1760	msedge.exe
1760	msedge.exe
4284	identity_helper.exe
4284	identity_helper.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4924	1760	msedge.exe	81
PID 1760 wrote to memory of 4924	1760	msedge.exe	81
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 3616	1760	msedge.exe	82
PID 1760 wrote to memory of 388	1760	msedge.exe	83
PID 1760 wrote to memory of 388	1760	msedge.exe	83
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84
PID 1760 wrote to memory of 4416	1760	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3cb858fc123036a322e8898b03bc13f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcbf346f8,0x7ffdcbf34708,0x7ffdcbf34718
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1352 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6937643652038746302,16734953988275836428,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 232c1e810b3d7ae97079fbb5a53dee60b88476ec5ab2a248b91959f159ed9346
MD5 516ea213b04cddc9ccf1e57d687f518f
SHA1 8f50e8609f8d0521b1f6002ad0f05a576fce2550
SHA512 c9ab46f19e353ad5d4fdd954057b60de90ce698d8993aa14d567890f810573e823bb85f74bca2c09da201237bc6aad19545e88be00e0774c3b07385636db81bf
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 cc9630f6ffea63d40c8a106a7fc5db2e0088d129dc0812a7b04cfee998591ef2
MD5 c787a8eb88f2ac095f81dcff2bc5f6d5
SHA1 bba787889f489761f43d0211e6cab0a216bee7c7
SHA512 7613a488765703540a16bfbe7289416c4289f07b6bbcdb3f214b515f8e6fc74dab4e9586e49ef96ebdd1378f42cbc21db131329d7ae7964d8151c9bac035f612
SSDEEP 96:nzk/oxm/Dnmqy1yswpvWMoiVmdeOAO6lI8g2IqQA0XUWQyV+VDCAiEwb:nzkB6ZssGWM+ALlI8g2dp6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7d5432462ddf0a9e110ced848612cb0280fcf4a44a02ac8469b65e3da538af32
MD5 b1b02e251286581d15237bebf34eee74
SHA1 2035b75882e86b08d1d1c75da471e35f143a4dba
SHA512 0944fbdc2a6345045f1fd1c4bf91406742662b217333e52f3737f0753ada0e9d59f7a1ecadae025c72586aa7fb588582127c90f241792a9ad8bb09dfeed11fb9
SSDEEP 96:nzk/oxm/DQYmqy1yswpvWMoiVmdeHIqQA0XUWQyV+VDCziEwb:nzkBIZssGWMXdp6ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 828d023674dc148e965eededb2bb89732dd49b1036bb3a0fed17fab4c760a538
MD5 823ebde884e5d42984f01285bb3dd414
SHA1 7c4e24d0b443271fb89a7edab6c9195374d433eb
SHA512 b3fcf180f5937abef7b41a9e4a92c233492ff2d87ad550240d1e6a90d17c9dac2eefabc0541c8d0c50a65d1d19fc550875abac846d057ef518f0a6913ae51a68
SSDEEP 96:nzk/oxm/Dnmqy1ySAwpvWMoiVmdeOAfUq6lI8g2IqQA0XUWQyV+VDCAiEwb:nzkB6ZsSAGWM+AfUXlI8g2dp6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4d34de029dce294b137b2cd75f8036827f7d23c2d2ebb73e20856353addd3656
MD5 a21cbc410d245941cc10ecd7ff4de237
SHA1 055d7e451e5b5637af2164964e05b9b88394e897
SHA512 c27b0b4bfb9e1af3dd744d2dd7102bddbc5657696741a8fd6102cf0a24b181eaf6feb0b4308f63b5c35c6318d2ea47004e09fa8bab342c8cda300e1df633745b
SSDEEP 96:nzk/oxm/Dnmqy1ySAwpvWMoiVmdeOAfUq6lI8g2IqmA0XUWQyV+VD7AiEwb:nzkBCZsSAGWM+AfUXlI8g2db6rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 01f53a235ae543c63f646ff8bf35a3d8412843fa7953bad7fc380f8ab61cc199
MD5 bbc9ff5c32ea17350bf90eb5823c47b9
SHA1 430cf88bbb29f85725ba396bf5ebfa38f0bda91c
SHA512 29357d3e9d347f0f92e3eac297d269ed10fa31a77cfb5cd7d85630a8b4747bce0b89aa9cbb2e5819c6b6d383c9cbeac09857fc419e2cd3a5ccd8fff514514d2d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupNp0ue2RU/dvS3z2OMDCRH9:A9iIxuERzA83h09RZxYowqSaOMWRHqlM
MD5 SHA1 SHA512 SSDEEP

Submit Download