583321f8e44c1e4f312f2fb64c49eac7e10731bc4ef6121185334b934a455104

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2314c106f22b6d1bc12d7ea56bb4d5cc_JaffaCakes118.html
Size 57KB
Sample240703-t7ze8aydmk
SHA256 583321f8e44c1e4f312f2fb64c49eac7e10731bc4ef6121185334b934a455104
MD5 2314c106f22b6d1bc12d7ea56bb4d5cc
SHA1 d5914a55af3583b16849e934088e04636f0f82aa
SHA512 5a026aff7783dc0fdb4b7dcf5a19aa2343ebe7c40b6f3413f5e924821e4298e70ac28cf80b188261af872a16ba77a50235d7959ba8285c799c085f257bc9bbc4
SSDEEP 1536:gQZBCCOdn0IxCDehWftfbf5fJfhfJfefffQfmfZf9fPf2fDf+fwf/WfEfifufPf6:gk2h0IxeFTRh5BWH4Ox1Xubmo3W8amHy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3232	msedge.exe
3232	msedge.exe
3740	identity_helper.exe
3740	identity_helper.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4064	3232	msedge.exe	82
PID 3232 wrote to memory of 4064	3232	msedge.exe	82
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 2224	3232	msedge.exe	83
PID 3232 wrote to memory of 3136	3232	msedge.exe	84
PID 3232 wrote to memory of 3136	3232	msedge.exe	84
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85
PID 3232 wrote to memory of 3892	3232	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2314c106f22b6d1bc12d7ea56bb4d5cc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bfd646f8,0x7ff9bfd64708,0x7ff9bfd64718
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,10782669293019305947,14673345866747117030,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 211KB
SHA256 043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
MD5 151fb811968eaf8efb840908b89dc9d4
SHA1 7ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA512 83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
SSDEEP 6144:U1jkj9l1xrxCD7bj/M3QiwUwTLo2xZ/gKep:U1uxxNQ7PMATU8o2xZ/jep
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 0a569fa95426e077f5804b9f97a6d4110fe09a401765bcdbf9bbe03c9f6c1a0f
MD5 376bd4e7280e2f5468143e3803dc37dc
SHA1 642edea161c56424c05fe6adb007e220b9d0001e
SHA512 7eaec4bdd24b8d3c59c1b0339b71cb1021bc0a81be03b3668a389c306daf1080fb69a4fcc5d87e855270ecbc8e9419ab4daa2695b3df7b1306bb24d6db890dbe
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 68b04083235b187229a355983087f8bc7377b3ea939a79bc4ec551def413070a
MD5 4866499fdc79fce23a379a7e40c4d633
SHA1 1a122ec6c6a82db783b72bc223d1a4c10fd86817
SHA512 349a888982b348fb0f7b7ea1b4ffad3abc7432e0127dcd9b1c014d1d82521757ba212d0a498e028a9ce596beaf89b8355f77aa52322e90988eeedf19496d5777
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d6c8f0d0404153415cea752964c87fe16baabec6b0de3d3dc0389d1e7009898e
MD5 d4b50efb186d8d6de8b3281a5419d8ca
SHA1 192774a4ee2febb1d143f15b0fd062ed1d78999e
SHA512 186d4f57f7dbc01cd3519b917e26aea51bda6270dc294b3020cb6f5cdeb99862848f01a0893bf765e8f99850fb4aca37c17e199b9f43648f6a90e28a91185cc6
SSDEEP 96:nvk/rn1PYvwpvWMoiVmdeH2WfSUWQyV+VDCziEwb:nvkrSvGWMXCro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 80b08c8aa652254398347c28fc5a80ea446287133c702eb4f0df13ae218d7287
MD5 f1f853796b7a21bcac8a921a1ae6e7bd
SHA1 d7d4a95dcaef3819cca49c9e996a48206c24929b
SHA512 58e8124ca80693218b768376946a5a61baf748488fe2544e3aa341ec35fe116f7dec13d41ac137cac2929a267b197f47fd2dc0b77fb51b0c08a44eb7c28cbb56
SSDEEP 96:nvk/Cn1PYnwpvWMoiVmdejGxlOj22WfSUWQyV+VD7AiEwb:nvkwSnGWMSUj2Crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 907c615bf4de94de349d0d25d75676dc236c742dc97384821e902ab7753a7f9c
MD5 e8b694a909b68d3ba84079e46ae1440f
SHA1 de0444c73fee42879c59a4b4212569b3a5a4ff4b
SHA512 782d86c85ba4a096a50536de9aa3326c866a0f9fa8fa8cacaad5b1c93067f118de2b461ef8d6fb8ecc12a7b7721bbe35b5c9599d914488853953489d3a7438ce
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmHfKe2RUfh/pygu/Vw6eo:A9iIxuERzA83h09RZxY88sXTDo
MD5 SHA1 SHA512 SSDEEP

Submit Download