f8fe3d62af0db91e0d50a00cfafe23f37d3330bd04b36b5a5f3c5d3ee55d74fa

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a523e0143ec4b08f4fc36a45ab24ebe1_JaffaCakes118.html
Size 175KB
Sample240613-ms4ytszapl
SHA256 f8fe3d62af0db91e0d50a00cfafe23f37d3330bd04b36b5a5f3c5d3ee55d74fa
MD5 a523e0143ec4b08f4fc36a45ab24ebe1
SHA1 1c01a36ac09fbccb907d1867295ca7be88972955
SHA512 50bef350517c18f7a560126eac2d5c90efe542f6f33dcab2e54dc5cf0ed8846beb9709b5a70b25f24e23fb5911648e96132ae387d7088158332b3ec48f63566e
SSDEEP 1536:Sqt98gd8Wu8pI8Cd8hd8dQgbH//WoS3xGNkFZYfBCJiZp+aeTH+WK/Lf1/hpnVSV:S9CT3x/F8BCJiAB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
988	msedge.exe
988	msedge.exe
4464	identity_helper.exe
4464	identity_helper.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 4316	988	msedge.exe	81
PID 988 wrote to memory of 4316	988	msedge.exe	81
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 2468	988	msedge.exe	82
PID 988 wrote to memory of 392	988	msedge.exe	83
PID 988 wrote to memory of 392	988	msedge.exe	83
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84
PID 988 wrote to memory of 3440	988	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a523e0143ec4b08f4fc36a45ab24ebe1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9671846f8,0x7ff967184708,0x7ff967184718
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6039009859472490150,3571304549201632347,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 9d3d1cf5768a5f4c56d7bb05d86b732bd5fd5d4320f40dbe1666b30d67f69f67
MD5 312f1978f4a7919f2c962daa92bd0722
SHA1 2b7c0ac0dabc7fa75b0d22cab03310c589671aa8
SHA512 91423573cc71624c9fb43a5e7b52caad9dc2eb67ced44e7cef93c7a69838fc72e3ea8006fed8fc076f6166de6b729096bd013fbef552c85574bc75aecdcdeabf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 05027a5a0ff6a74ff88b216eb98b397586352386496518cbe0848a24ac96d0bb
MD5 021e86221edd3c4fd8a23704ce10238e
SHA1 9b6d8a3d5faf82516017bf3df8d0f9632e25fa0b
SHA512 479e6df654fdce52a56123469caac8d7a4c16f280a5660d355b2dacfc548b4d633cfbaac79c080607914b5ab04253d07ee2cd06d717a7b0365e1b6321de5c7ae
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 04027184d2c9fe28947aa4cf719b24a49520343c6ae0bc3da87be8e16fbf729e
MD5 c57e8ac29e84f1d762dc265a00b42f21
SHA1 ac780957bebad4a5565eee26cea983ab844724d0
SHA512 8b2768fbef0a9309b6675ae4cecdf01aa3165d2dbbc5cb35833280c1a1c2015afb34087d35bcacd1647d208e41c326c9983f566ce6e9ab967557f60b6c9eb458
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8807eb7f309ace8e92a4f0978c9621cfe5f59790b1244a4e0bb750fdef10f350
MD5 2f636fcdd1fea8b0a301b309e0188859
SHA1 0fe25ab6a89299196341a411842098415670492f
SHA512 126c654e254c5486f1cf10ac506974bfbf57da159c009eff875035c395dcfbc080f8105c0fabfb7a77ced9de979f8d0bf6e9cbb4cf5cc4ccfe407796105ff329
SSDEEP 96:nqPk/oxm/DQYmq6T1EswpvWMoiVmdeHIqQG7UWQyV+VDCziEwb:nukBIdKsGWMXdz7ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a1d72d87242d0e4d6e436afb610c80f665bec9620d7974fac9fe9bdeedd846bd
MD5 c37a2b77979746c4b73203694610564e
SHA1 1336690e57fb7643d61c70f48b2cbb0aad0645b5
SHA512 832029570861e3ce39fce3d42b00b50c0c3ccab6cba86fefd048fb5c358a20a00eb40f37340d8f26c77317f30d928451668e5efa5012b161b33732e0eb03f2d8
SSDEEP 192:nukB6dK9GWMwZdFYr2LEr7Er+YKY2dz7rg:nu9KwWpORrQyxg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 22893bef443696c83ec2c92b4fc723945ac53f126ac15562f4606904fd296be2
MD5 f29e4b2fbd2e485272984662ac65f9cd
SHA1 1486f2b2af3561aadec89ce67f17c145b20307e0
SHA512 4d3dfe9a7da101eddec4a3a67c48198cc7e544712f86c885448faefd19389135f9f4500ab04688eff9f10b0b51f0e53f5259c4286ed3911ff936a63906831405
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi2p0Le2RUHdvF3z2OMDCRf:A9iIxuERzA83h09RZxYebyFaOMWRHql+
MD5 SHA1 SHA512 SSDEEP

Submit Download