bcf03b064edc2df9e9da0c326826efd06021f92bb977f0c04270410dd4c7be30

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a63bcc61a4ce0670b2703b5e17b7f88f_JaffaCakes118.html
Size 175KB
Sample240613-srv77athng
SHA256 bcf03b064edc2df9e9da0c326826efd06021f92bb977f0c04270410dd4c7be30
MD5 a63bcc61a4ce0670b2703b5e17b7f88f
SHA1 fff8d57f5e32903a949eff476e899abf5e595554
SHA512 17469f3863eba939901c6860451a805c97736fbc038c3a804a2c091e53ff0e3c6d69337765234b0c5c816e8cbad13b19bf75657c84606f3739842035fdc87bef
SSDEEP 1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS31GNkFmYfBCJiZe+aeTH+WK/Lf1/hpnVSV:SHCT31/FvBCJi1B
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
724	msedge.exe
724	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 2448	724	msedge.exe	81
PID 724 wrote to memory of 2448	724	msedge.exe	81
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 1252	724	msedge.exe	82
PID 724 wrote to memory of 3484	724	msedge.exe	83
PID 724 wrote to memory of 3484	724	msedge.exe	83
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84
PID 724 wrote to memory of 1536	724	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a63bcc61a4ce0670b2703b5e17b7f88f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa603246f8,0x7ffa60324708,0x7ffa60324718
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17136543201994565579,7599552269080086068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
MD5 db9081c34e133c32d02f593df88f047a
SHA1 a0da007c14fd0591091924edc44bee90456700c6
SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
MD5 3a09f853479af373691d131247040276
SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
MD5 SHA1 SHA512

Submit Download

0ab3baff-d005-4766-983d-e0afc0985199.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0ab3baff-d005-4766-983d-e0afc0985199.tmp
Size 7KB
SHA256 2ce346e5ef6a7c69228e73f8ff192611c124cbf6e7db6df1148d551e5be2be1a
MD5 960e50509ea8603903d97b1d1d1a9980
SHA1 80398b01a5fd97c4cc5514ce985a1e3bb349dabe
SHA512 d79ec947b37dd76ee972e34990bb042ef5eef502c1f24bc378393d54b8464efd5d0e21429e33731696f3ae21a3e634f2f7550042e967e94a6414311b7744d5b0
SSDEEP 96:nDkVoxm/DnmqN1d0F/wpvWMoiVmdepVzRfzExq1nErwEDTny2gi4AUWQyV+VD7AE:nDkf6SERGWM591Yxq1nErwEDTny24Arg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 67dceff1ec5482a945e76c48a4c234cc87ac1eea473497727803c9d51b473643
MD5 b209a305c806d5fbaeb872f96aa94e69
SHA1 5d8315e147ed2bf6d3fb32b571a734e5214f0312
SHA512 7029a16fb2bbe6403db780336983a75fcfed701a17b21f2d460ced173b2f65fab14ed5fe67f5ecf66a14ab082daa1ebf46be13f034e8c652b45eba3e9c965efb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 6be6dd2258c884dafcfdf34b4360c4d9dc5c5a6662a627363169dd221f9d5d79
MD5 074314d293b0510d40422bccd72a6dd6
SHA1 f47d3e8c07a28e9c2d06e0423fcae05c736f70f2
SHA512 248c34fd59dca56795a85ea25cfb2525a8cbecf34d2ae46bcf73d1cc27525fbe9f36659a7c08f67f28d1666d4061c5ccc4f2acee8a3046f6f1df15d1d923d1cc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b27bf1c04703e01de40bdc866412108a17397aaca0e5ed920c395210ad40654e
MD5 452453a0f101989418e494d2d1dd8a0f
SHA1 baf531da415e692b59f5ffe97e6bd9ef17834486
SHA512 57731dd358be2ca582bff3c0e1c10e5ee713097d33c6433a2e0949ef115e564bdfd45a758aa29104dfd6153b8b4bfcb5ba1e1693e880fd743fa080993ffdb03e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0a903858c44dcee536c71f08582a6c0fd92cbfd6dbd83497d19ae1dd9956e56e
MD5 b24bb332b4709e8aad7a8b80e5c8785f
SHA1 ad8598972b6eb111445b19b14c5c51811cb4cb5e
SHA512 b65423f2f71593a957d4f900088541645184fe4ad56d54a2f8d8b5e2bec673a17904528aff175eaab116b86d351a7a2e7ad77ae84e14e6a9de7b83a812cbca6c
SSDEEP 96:nDkVoxm/DQYmqN1d0W/wpvWMoiVmdeHgi4AUWQyV+VDCziEwb:nDkfISEYGWMX4Aro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ee30d7f58f0c7bc4089a6ade05cba9d40dad97902e9c7a6baf8a62552ae168ec
MD5 b101bd5d4f487cb59605a11997428583
SHA1 54cee2a30a15c406863fa057429d03018623c062
SHA512 417d652cee362e9ca745fcba61a445f4fc6a20fb88714d7e86baaca639f0bddf6d49a71a972a1632a3354a6ba32ba6a40cae9b66d6fc8c46d58cba22bf049c26
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup95de2RU12kb3z2OMDCRHqZ:A9iIxuERzA83h09RZxY955cbaOMWRHqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download