2e64d69f847f7547a7bb6b1c10b8e6b25cf70da0d1866d2dbe7fc3a128518630

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0ac9aa554de3b0a58f8380ddceab499_JaffaCakes118.html
Size 69KB
Sample240825-nwv1rsseqd
SHA256 2e64d69f847f7547a7bb6b1c10b8e6b25cf70da0d1866d2dbe7fc3a128518630
MD5 c0ac9aa554de3b0a58f8380ddceab499
SHA1 60b4dad89daff3f063f57f4885a312456546019f
SHA512 ad30230ee80e0766c0cbbe79d00c85cc0e9c8467c1d5022d3c94ee5981db654e9d631ef8ea9fd2ce5897f52216fbca2546f7a0a40ef19b74709ff18b49bcd9c9
SSDEEP 1536:gQZBCCOd80IxC7THqoYGcHKfEP8ynz+mWLbx0IzeFqwjFQ3iUGkpisgnv0drQwaK:gk2u0IxwqoYGcHKfEP8ynz+mWLbx0Izx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
4712	msedge.exe
4712	msedge.exe
4564	identity_helper.exe
4564	identity_helper.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 1276	4712	msedge.exe	84
PID 4712 wrote to memory of 1276	4712	msedge.exe	84
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 4436	4712	msedge.exe	85
PID 4712 wrote to memory of 1272	4712	msedge.exe	86
PID 4712 wrote to memory of 1272	4712	msedge.exe	86
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87
PID 4712 wrote to memory of 1244	4712	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0ac9aa554de3b0a58f8380ddceab499_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf51a46f8,0x7ffbf51a4708,0x7ffbf51a4718
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16030259574174651859,15738075527068960948,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 212KB
SHA256 af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174
MD5 2257803a7e34c3abd90ec6d41fd76a5a
SHA1 f7a32e6635d8513f74bd225f55d867ea56ae4803
SHA512 e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540
SSDEEP 6144:Vx/FFLxc6Jo8OPkxKcTfIaIWotgJKCS6gC6FF5:Vx9FL68OcxKcTLotaKrhF5
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 ba80bb8730c3272ca86d426fa77aa7cdba22ee90847e4986abf688c8b93f62e2
MD5 fad176cd23b387613b4a80aa09a756b7
SHA1 47f424933b0a1312116194aa249ffb51799330d7
SHA512 3534038bc46ad471b76e5f434a85c76853ff7ef526409ed1a0f795282b717ee6ec9296655bda3386ae41bb1d8ade94b6e8534481fb2a08bbf7c1f598b897e689
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 f863c2a697822398fc7f67233c3b4676833c69cad9578a040d8282e752c140ea
MD5 02939787ae818534b01da4439bc9567e
SHA1 ff8b2c0d3d82777ac278eff99903a8e7641d2050
SHA512 2991ebd12654c5920cf1083644b33435e45f9147e56bc8e08876ba0dfc5d53d82f41b90f632a9a98160b39591a5404b8dcad0235870d43132344fcfcfbce508d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 edbc7ef47fdd88ff9b902dc7bb4c2050d24e04005807db534e528b1751423c04
MD5 bffbda302cbfed2ca3a5265c1370784e
SHA1 ad66b726e75b758ce337a9a8089db0967c5f510b
SHA512 ff593b642190b4f6a7dcdf4f5db9c5b2420aca47783b4675ba9368ae2e48f11875d84271730ef9ed2c57bc4525e3af70500e0e19791c9b923b21442f79a2e4dc
SSDEEP 96:nJAkzFK1yQLSFhPwpvWMoiVmdeH/bCUWQyV+VDCziEwb:nJAkzIIRFhPGWMX2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3af7ed2bdeb90495dea464517a65e803b174c2fe7e8c15d7d8528e62dcf3a48f
MD5 488b85d527cb568800ff1090d1922397
SHA1 dc955e8a8241d47de09ca699ea32983b5c5825eb
SHA512 c7fc6feb10044aa7c49acff9145b997b229e4d127e1be9ff4793d254a9a051c162852a5a911f2532836fdbaf13687e37894810453555e8e90c1c98534c697b99
SSDEEP 96:nJAkzFK1yALSFhPwpvWMoiVmdejGVPM2/bCUWQyV+VD7AiEwb:nJAkzIIhFhPGWMaPM22rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8197023ac66da727d4fe76867bbf3971d96b49550f633c6ee19ab3848f145943
MD5 0fe5631fa960f0aa45e4dfceb6bdfe49
SHA1 d494f77b7c96171a389bfe8500a772fdcf5dd598
SHA512 7107783e5809589289d717c3fe6e81b10c9060669c5e26c22d92e9b8757d27616d83140a6d22e7ddf63f314e9660794633b46294a56c95f6cc74ed5221624b69
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOfFe2RUsxNzRw5Ytj9Zklh:A9iIxuERzA83h09RZxYOfhRUkLssIB
MD5 SHA1 SHA512 SSDEEP

Submit Download