cafbecab5c1251df7c1fcd0a9251fa4476b92fbedca8f7d4c559cc0ed9fd8a97

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9c3c27563d3ef7d5c412b6a4c47ea87_JaffaCakes118.html
Size 117KB
Sample240823-bgtsyaxdnf
SHA256 cafbecab5c1251df7c1fcd0a9251fa4476b92fbedca8f7d4c559cc0ed9fd8a97
MD5 b9c3c27563d3ef7d5c412b6a4c47ea87
SHA1 82855d27eaf7bca581acf0dceb810041362b54d7
SHA512 cd3e7fa3fe9a1082c32f896df64d981ba6bd759b95c24d7781b092205653c161803a61d39a1464d2c15e0a1c4f0e948749c8260ba2d7760d2e0f974f4ab9fdf0
SSDEEP 3072:pUcdcXmNRSFrcdVuj5AbJJoBubExMhPIxjN9rCX7CeBsYM:mXmNRDJJoBJ5n
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2436	msedge.exe
2436	msedge.exe
2208	identity_helper.exe
2208	identity_helper.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1468	2436	msedge.exe	86
PID 2436 wrote to memory of 1468	2436	msedge.exe	86
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 1640	2436	msedge.exe	87
PID 2436 wrote to memory of 2280	2436	msedge.exe	88
PID 2436 wrote to memory of 2280	2436	msedge.exe	88
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89
PID 2436 wrote to memory of 664	2436	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b9c3c27563d3ef7d5c412b6a4c47ea87_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd99e846f8,0x7ffd99e84708,0x7ffd99e84718
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,5453048006816838827,13188014185593599419,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
Size 212KB
SHA256 af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174
MD5 2257803a7e34c3abd90ec6d41fd76a5a
SHA1 f7a32e6635d8513f74bd225f55d867ea56ae4803
SHA512 e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540
SSDEEP 6144:Vx/FFLxc6Jo8OPkxKcTfIaIWotgJKCS6gC6FF5:Vx9FL68OcxKcTLotaKrhF5
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 188224b95bf9f78f981604127044cf57723d786c5e5ab585b56a352ed3c5db65
MD5 e4570a3da2756c88a41836f75b7bb10c
SHA1 d0a373ad782a8a9fcd148fa21a35301f5266b75c
SHA512 86276bbcb52526ad4e749b7a723665979597a2b634bf46d69ad06e1081d6115edd6f8ea8c0305ddf0183880d9c45e6e08a3beaffaec016a772040bc922489d59
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 bae24ae62cf1fa3890c1ec084f7a3148935ff0b0783a679a5bb5678628f6a9fb
MD5 3188cdd130424f35044d1a6a511c4e9b
SHA1 70123ece9ceea18e47105f444d5685a2aa37bdd4
SHA512 0fef1beed083bc06e96cf05996bc987c3b3a1d27af20cca6aa354d4df0477faf6b9ecf1c351c202890e9c548e1a0e7f3b80c45f621975af85e93ca643ef9e68f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 04902252ccc57ca0849a894baa01b7489b5e0cd89310a8e4b7338ab77215ea76
MD5 91906161e8d9bfa09f525def27bfeff6
SHA1 f94daa5d35a196b3a6ec941f58d0b12d88ed836f
SHA512 32b221389dd5b0ab61c09c7056040ccdb5f735d2dbe43ba34c7ac2cc4bc008f2fa3e13cd6828d98429ca30cb5d8a6fac887a022dc263642060230c835d6aa1ff
SSDEEP 96:nNk/Fi1FXOrwpvWMoiVmdeH4s5aUWQyV+VDCziEwb:nNk/gXCGWMXaro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a0d51bc80317beeabba645532b2534f460e93e6394ed0424a7b680078d066496
MD5 080bf6f8900c680b7c113ce7da4026cb
SHA1 629c6ee2f0e367e14e78457721631665c144ab71
SHA512 5fdb335958951b3b270a0b6ea7c8c772d5d15bbbc5fa6e3353f688173135b3a8d700e1a13eaaa8ef5b505d8d723cae75f04e25d2870293540ab67612c73b3cf2
SSDEEP 96:nNk/Yi1FXOrwpvWMoiVmdelfIvJcvi24s5aUWQyV+VD7AiEwb:nNk/DXCGWM1fUcvi2arg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1bf3ee07e65e913db2c66770a9b80b7d5239c39a5776a0e55a994284836b3315
MD5 620093d6b7a39c0811df944ae36f8926
SHA1 25a10897d3b7ec86fde30ac70c0398e49ffa1af7
SHA512 98146ef800f3002f0ef5a333d0fa50c8ac040188fff46fdb7435e1b699ac682f77ce0a336c8447be9f7124d2e82c13dab7872e85c430eaac4aa7032f37dfd294
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTe2RU+i6sRw5Ytj9ZklqsU:A9iIxuERzA83h09RZxYDtHkLsTIv
MD5 SHA1 SHA512 SSDEEP

Submit Download