d66ad5db3ec000ff2ee81c8c49c8bb8f25093978da8e212c7feddbdeba0769fd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ae560bb4e158ca6eec8e8a8de37f2fb_JaffaCakes118.html
Size 57KB
Sample240708-ehqpfs1epl
SHA256 d66ad5db3ec000ff2ee81c8c49c8bb8f25093978da8e212c7feddbdeba0769fd
MD5 2ae560bb4e158ca6eec8e8a8de37f2fb
SHA1 062a81c178b5c6e9e37c350665e00a1c1d931466
SHA512 f80eef503cb53f267f7e6b1363b597d7cba5531d2480e76fa4e4d071816d1bbf5e3a3f846f8401d2aef16cb5723d033fac904fbe00790b15ef9184e6359d176c
SSDEEP 1536:ijEQvK8OPHdFAPo2vgyHJv0owbd6zKD6CDK2RVroNAwpDK2RVy:ijnOPHdF12vgyHJutDK2RVroNAwpDK2m
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3032	msedge.exe
3032	msedge.exe
1448	identity_helper.exe
1448	identity_helper.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 440	3032	msedge.exe	82
PID 3032 wrote to memory of 440	3032	msedge.exe	82
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3588	3032	msedge.exe	84
PID 3032 wrote to memory of 3664	3032	msedge.exe	85
PID 3032 wrote to memory of 3664	3032	msedge.exe	85
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86
PID 3032 wrote to memory of 856	3032	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2ae560bb4e158ca6eec8e8a8de37f2fb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc96e146f8,0x7ffc96e14708,0x7ffc96e14718
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2810254769291759951,14654275536741157064,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed
MD5 3c78617ec8f88da19254f9ff03312175
SHA1 344e9fed9434d924d1c9f05351259cbc21e434d3
SHA512 5b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 91e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7
MD5 09c7ae658385f6de986103443217840b
SHA1 298d880503edce4413337c09d3525f27a2edcd28
SHA512 4e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 3078ef0ec73093805a7357df4e4d4e2a9af43b4796adcab8126f5db57c52c379
MD5 02c046233e6a2f9fc071e82090918fb1
SHA1 d4d3dbaf8d985f3caf704e885f741600915d38ec
SHA512 f7253120f2993ab17f8e74d375a00d339287e5ff957f9b8202d4682af2cce2e81b76a12ca635f949b175b3674f82fb29cea57668e5a809e3f3d033037b5b7738
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 eaba7fcf40bc3b5320912716140c4584d0ee8e9830bff0b327d6ec4273788ac1
MD5 22f15a22ca6091c2d254872068b56a76
SHA1 e584dab2e24f9d55af35679216e76eb8d5e0a7a0
SHA512 ce5f66ac19cc626dea5220c2921eeb62f63da22fd2555267426450f5225e9e5aca9cf11e62d48e91a6761eb19888a72f58a4715e2562c672c6dbd5b1ee5ea544
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6a9a17ffe674a7419bd1f1920b07e448b1068a9553faabcc5912ca637633927d
MD5 a31c9a07b5ea40f56d7a37f1276c73bc
SHA1 0a2aca0b6c0712c621fb7ac1037565a66f1469f3
SHA512 0afdda53f61f3dbec23588e3c06cc57e82b13329397e2cea9bdf6900bd7541f68d2ec5432d8072dca2a09a7e91d93078d036b9dec7a7305dd686413b4002e1ed
SSDEEP 96:nSkvF818UKwpvWMoiVmdeH1TcUWQyV+VDCziEwb:nSkt827GWMX6ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 af3dc82a54cd36ad824ee43f125c27ae544fa9e68808743017c32adcc536aad8
MD5 d3cb502ffde5427882741d325e91eb7a
SHA1 c9fbd9c60551bc3beb7a1cdb182ea06e3374d255
SHA512 cb8035c5191db458fe7cc9491119d18719bb5b5a78c6d3d96f103bea446d9242530388b8cb319637ee595d87792ecdb644a164d543e5881e93de34fb3da65a0d
SSDEEP 96:nSkzF818cKwpvWMoiVmdeMZDGxIVKh21TcUWQyV+VD7AiEwb:nSkR82TGWM8ZDGxIVKh26rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 62c6e232b39f2a0bc047d5044b68db5c2d9e68dbdc72b6a200d5e2d678f26e10
MD5 461fa08dd0acc95c7b2ca3d2c9427cb0
SHA1 fc39e8513adb5d5ee8395838521431c9d911ac32
SHA512 5a55f349bb1a2102f03595b3d75517ca550e7b416ff7244b741dee59635adf7e08d030e6a9a83b537841e56113c80465bb7974416ed351832d906bfa129c1577
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuplN0WOfe2RUv7ovfyuSB6Vl:A9iIxuERzA83h09RZxYPXOnsKfyuFv
MD5 SHA1 SHA512 SSDEEP

Submit Download