639f8e15e0b3e290e4fcf83a9390c9242262f1dadb9c9cc0a5d6fb9a23cec5ec

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0abb9a098672935505cb88a1e8a34d1_JaffaCakes118.html
Size 153KB
Sample240825-nvmm1athmq
SHA256 639f8e15e0b3e290e4fcf83a9390c9242262f1dadb9c9cc0a5d6fb9a23cec5ec
MD5 c0abb9a098672935505cb88a1e8a34d1
SHA1 201693ce5bf059cefaa0547d8e3cd5aca73348f4
SHA512 a4228cd9d93766148367d3b1366288363973d048154a9444a8827cd376953ece3c8a941760c5c6b1e5590efd9dfd9e1f7c35d837ef414ec627e1fb88e7c44252
SSDEEP 3072:iF3SR3Jsza5krCO0/V/8rnOL55ShutT0M6Naw38fU7ienQpfQLPya+KIstwh/kBS:2Cj5krCO0/V/8rnOL55ShutTO38fU7i5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
336	msedge.exe
336	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
2020	identity_helper.exe
2020	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 3872	336	msedge.exe	84
PID 336 wrote to memory of 3872	336	msedge.exe	84
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 3220	336	msedge.exe	85
PID 336 wrote to memory of 4724	336	msedge.exe	86
PID 336 wrote to memory of 4724	336	msedge.exe	86
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87
PID 336 wrote to memory of 1260	336	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0abb9a098672935505cb88a1e8a34d1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2e9046f8,0x7ffa2e904708,0x7ffa2e904718
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14606638139607342264,13227521592630207360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 3fba3329653710af015ac33cb462198e3687d452b0eca8638bc1486ff5ba7e0d
MD5 cda5807988b6a4858a8b50948b5e7405
SHA1 47b394a8c51d0294da9a50c17b614f875ae0258e
SHA512 a0e07aa4334fc2518508ff197e853392d5009582a1b596383c07102266837be5356182d84d667a0f9c759dc794ec34b472fbb81be8a0a735dde72714d3658a30
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 2c26b23cde1fb98df7dea879b019868e0fc9a4e8cf5537501d4f35b4a46ea414
MD5 8f930ffb5d86f2497e22269279d0247b
SHA1 55f92f0d17a95baaf367d9d28add1400e5d58a0d
SHA512 f6009bdac5f3d70513281d856b895cac02ac781b6a888bd4dda5f5f720e1a9b44529b4bb52714a419822e33453361a7956abf1cc3251ff3004a8e2a9c60fa2e7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 40f81f919be548249a0291e3c67d8a8252af358ca4b7016ae310d82039f9b0d3
MD5 1f50b7f8af79d4b298fb05c49c201d1c
SHA1 7614ec836fd8fde300d271b6de53d6a4aa54daca
SHA512 8ad1b019bcf7b012f952a97612fe3fe5db724ad4e61dab753e3881a09c358a6bc6e4d44ab12e7c96d73186696fb8b9b939baf9f91d53e582bf10831560f8e605
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 533a81b7e210bd5d0d89a35039750ff55ea07e2e68c6cbed4dbffb6e737cf810
MD5 c0d43a218d27ee0e0a789af6f3834451
SHA1 62b4486cbeba2cf1d0820f0f57d6d1ca733a07fc
SHA512 339527caeda2e9b39d22a6a8046357a214aaccd32f8d5602f4b0acd45060a8c56d9b5b514f111349beb4fa2b7dc5f1d23d127e88d25601dea40a9f754457aa51
SSDEEP 96:nmkRF1QZs1p/OrwpvWMoiVmdeH4s5zUWQyV+VDCziEwb:nmkR8Zs/qGWMXzro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e35fd9dc476467eddedc7a273cc098e1e7fde2a90059150f75872f34cde59678
MD5 b258b0d8fb51ade0fcaa120424628511
SHA1 9914bb8455d3bd235070d3127673035abde00c31
SHA512 db2564e37819f7c72e0d15451fe76ff221642bd33d676eb8894c1a64cdf66f423ba4cfe5e63b891919ee87f78acc2f94c483514b4df82f7d7a949e23707102e3
SSDEEP 96:nmkRY1QZs1p/OrwpvWMoiVmdebfM7e24sizUWQyV+VD7AiEwb:nmkRZZs/qGWMrfM7e2Wrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 758a1971a9b59e583d3d43d0c0e791ca7596d65ca3f80934028d1732215053e6
MD5 35eb961c6dcf5823f72b0535756a6207
SHA1 cea56a7d7d73b5c7aa3fb278e7238e9982804c6a
SHA512 278a0ba8a77707b443ae03ab8fb45caac9cea328fb842aa4ffad2895a425e69d6efe72bcf3efd264167163b4704719d6ab02ff8b463e84a4d9872a090b2d21a5
SSDEEP 96:nmkRF1QZs1p/OrwpvWMoiVmde7e24s5zUWQyV+VDCAiEwb:nmkR8Zs/qGWMLe2zrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e729b792fd8e34c6ecdffc39646475313871d22cc73e4f250bb6f4997cc4d79a
MD5 9bfe8909747c1a80ff80e660683ef469
SHA1 10c28d0503c95c61e7bb330e7c811bb728243313
SHA512 c5335d373b3e44c9bc4d6db8b4c7f2153f6d54a83f62f9709fc26c732d8ea23781642d5242ed9c9a3d6bddf876c9bf9ec9f6b4a8d272b4cf9d984d0a098c3f88
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGe2RUji6eRw5Ytj9Zklqs7:A9iIxuERzA83h09RZxYIQxkLsp+k
MD5 SHA1 SHA512 SSDEEP

Submit Download