6c41883aa1ef20e9143cee3d84cb7b7b5f3bfef1e8609541163dd6a5eca25ba0

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a51e07087c2849094e12c59d1e5fd95b_JaffaCakes118.html
Size 9KB
Sample240613-mpnsfavflf
SHA256 6c41883aa1ef20e9143cee3d84cb7b7b5f3bfef1e8609541163dd6a5eca25ba0
MD5 a51e07087c2849094e12c59d1e5fd95b
SHA1 a6796c7c77e1436ecb5bea1b2b83866a68d8f2fe
SHA512 346f4a239f8dd0fdd7adf3edd5a9d9debd473a85286f366d03c8db80c0350d79cf41d087ed490c6bd4a2b5c981364026eb705dde115bdfcd3c79f7b7467c2408
SSDEEP 96:co3KUt4RbR+5A+e/jftfHYF7SYuR21H579mnBKxAj4RbR+25JzEGcf6T4tJRDPGF:cxUeRd++jlHYvmBWRd+iE7RD5NU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
4928	msedge.exe
4928	msedge.exe
3276	identity_helper.exe
3276	identity_helper.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 552	4928	msedge.exe	82
PID 4928 wrote to memory of 552	4928	msedge.exe	82
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 4508	4928	msedge.exe	83
PID 4928 wrote to memory of 2444	4928	msedge.exe	84
PID 4928 wrote to memory of 2444	4928	msedge.exe	84
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85
PID 4928 wrote to memory of 1152	4928	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a51e07087c2849094e12c59d1e5fd95b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9082a46f8,0x7ff9082a4708,0x7ff9082a4718
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9740737585294371332,11914894334169756432,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5620 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 3a1206a0effc0f808380f5daf5aae97805675a47ef3e19dce4f19f7b6f9138d8
MD5 501d7c0974a15707bb0fa1fa51041c26
SHA1 a831b226a6be337054fc5bd567301ecb5f6a8121
SHA512 2d8813ba7f408a318635dc93a5a3238933518d9f6e31cbfee3cdaca0b97ab1a4a229fa638462379fadfede503551f0ffd1963be38bc2af085a15c68425cd1c94
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 cc7cba20d5f9fc5b3d46a7ac5299c2fb2f57abc91000f0b31df5efc03f0c353e
MD5 d6ff75991d6e98fa3c04462c22e40ceb
SHA1 a4192af67bec00554d915b3d24765eccc65b2609
SHA512 ddb55442cc378e63da7bbc30fc866ad4dd5d8a007f6c1ee4fc71f5382605cee6a567fb58593154dad13c26179171340e423ebf0cdc2228e3c2c19ec9e09793d2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 727B
SHA256 30145caabbc3963c6ed03887e4d58c593f935ec57ebdac61d951a6753e44460f
MD5 aa8be6ee17dbe2cc84cddc9e102c5e12
SHA1 eadcc07a5b58b5b26e889dd481b66fb4e7e34e73
SHA512 bc2e595196f7a11d485ce08d23a3bbbf3f3ce8e7c8aeeb9f98d16044d2452035d0c0c15627e8ad9041bf67f060e908a067d295e3f3ec5044203dc48eb31221ee
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 492B
SHA256 3d742b4443331e9c575586ea01fa38abacbb39ba100218dfcd5a112db3e1897c
MD5 78443a873721d9d000daf6f2352c62df
SHA1 77d1215619d81655a9d9213b325b4fc263f0f482
SHA512 2f15eaa164fbccb3fdfb1bdd423604a44f0268936006d91f283cf8606e3380ed774bed309df0396da5c93e846b42f89c0a9571ef5fbf4ce71b108e3d946ef3fb
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dcedc76d7442b681963c9867bd04952be1771f69cac0566788d65a8741cb4610
MD5 69e1ba482c83b110e0eb9ea474e7b450
SHA1 610c106a1727c5862a26a35d0bf2faecbc242e1d
SHA512 26fd5a7e5928a46b6ad85fdfdbbab56e95b62b9fdb3356d05244851826d185da6be40c1c21c869d9230c52292fb553e0de1541148da45e8cf138591b08408b2b
SSDEEP 96:nnk/oxm/DQYmqHL1eEeEcwpvWMoiVmdeHnagyUWQyV+VDCziEwb:nnkBIQ8EebGWMXLyro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 18a1d344e5e9dbc80325648bdaa4b0888d80715e0a00dab02ce3a50f8b226e98
MD5 efc3aa9014990f90eeb1a371f8a86b21
SHA1 360e924e57e28fd62a1123ed793b831347e5c205
SHA512 9f10f0352d687eb59a064c9e2517f90f79199e9ea735c129d0e5ec47afd92d4d930ddacbdb4934e18c105e939a460214da64c55bfb6655408194085620c44125
SSDEEP 96:nnk/oxm/DnmqHL1e8eEcwpvWMoiVmdeM2a2nagyUWQyV+VDCAiEwb:nnkB6Q88ebGWM82a2LyrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0355159616f0d4c21c04d7ff5db65a5f6f70813272f760504d9ef11fa927e537
MD5 8e49d8ffe7ab838c2f6967ccf678c70d
SHA1 7381b5a5ad54766c9149b10a89ee113ea0cab1a1
SHA512 2c69f84a54035511f4db10264a71f3baaccbd61e8f58900f8ca2d7fc8d8b438b319966e7048f90a937c665d1695fd4126651d8ec1b1856d0e90193822257ef18
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptSXe2RUG9tx3z2OMDCRHqc:A9iIxuERzA83h09RZxYMf7xaOMWRHqlq
MD5 SHA1 SHA512 SSDEEP

Submit Download