beec5b3e7eff178ca16effec4398ecde769dcb71d2cdf31850e3d91c7f83b1d8

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2b644ae57fc927b74d080a77c42809a_JaffaCakes118.html
Size 45KB
Sample240907-ylsg1atgra
SHA256 beec5b3e7eff178ca16effec4398ecde769dcb71d2cdf31850e3d91c7f83b1d8
MD5 d2b644ae57fc927b74d080a77c42809a
SHA1 a9684a9f19ed012730106a3ebe53d33fc72de2fc
SHA512 b14b8de55866ec6f94add1f915538b7ce000a5ef84ea93da6e308725fb9f8f6c2dc1e22c2b6eba70a0506151b3c9036bc7c30699878d5827d23fd3eda65a56ba
SSDEEP 768:05ZhR6++9kI6AsiKh1DhZL8FFnEOM5+vW1x6qfDo8LNovIEnnez6/x29Lqz:05ZhRz+9tJ3Kh1FZL8FFnEOM5H1MqfD+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1928	msedge.exe
1928	msedge.exe
4712	msedge.exe
4712	msedge.exe
5040	identity_helper.exe
5040	identity_helper.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3532	4712	msedge.exe	85
PID 4712 wrote to memory of 3532	4712	msedge.exe	85
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 3652	4712	msedge.exe	86
PID 4712 wrote to memory of 1928	4712	msedge.exe	87
PID 4712 wrote to memory of 1928	4712	msedge.exe	87
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88
PID 4712 wrote to memory of 1600	4712	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d2b644ae57fc927b74d080a77c42809a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b2d46f8,0x7ff82b2d4708,0x7ff82b2d4718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7025496035070080660,10608286690125579760,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 477bd644d6d13daecf1f4dc87cbfe1a5022de2e24175027d42e70115f75e3127
MD5 5170d34d9348f7e9a5e272d1f4054511
SHA1 be954aa1dc7d045c64463f9299d0a2c7d5dce3ae
SHA512 c70c5be571e87790f003df627d78009892de16ed7f8d10f86baa204a3cbc6629e106b8bbc1375c70b2af77a697234eea35677eca593a3a22b7ce2cebbc733d72
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 f6a5d5865ad6353ea1675e0fc406ed16e5caa2e99adc8e2e6f319350b5208eb1
MD5 aac69314f1765f3a18839d59be7e9835
SHA1 37cb18b29fa0f8ca3bdfbdc505d4c211618520f0
SHA512 01cd5a807124251346f92d2628bb61f3be01733d4fc1a648d4bf4d3e6153ad8a73f26b2ddfca9dcf3506d7eea15865b08d30202a45c778f889461d05f7070fa9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3e1551f4b219e25471f86fc97b3bc1613de8ab1a02adfac3dcfc9a5b651c96fd
MD5 58fa3dbcd490329be1cb09c2d9ac5a02
SHA1 a6016879aae52937df371376b4bd95ba05f08083
SHA512 fa22a6ebb257565cb534e849c4d51a9ef759ac1e4d8b7cbcadc87269d44cb77410b47e53379625a5068ed1519e873e13d40f669c34e0634db1ae3edaf3594db8
SSDEEP 96:nEkzPd21dRwpvWMoiVmdeFV7hB2m95+UWQyV+VDCAiEwb:nEkzoHRGWMVV7hB26+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c7628ef8a3ba3a535be03a8069f2947a26af12d366dd8a02ab98c7568f1c6354
MD5 2679bb4480861b84f131aac53caed2d3
SHA1 2376bd84346c3e8bf4e249c26e601afa1d35f5c2
SHA512 34151132b2e768fdbc5d91db13b93a1c6b4360d53f02c586952235190fd1fc9aaef6591d09abc543a0a4fab913c73770fa8616001403cd00c087376b08c630bf
SSDEEP 96:nEkzXd21dRwpvWMoiVmdeHm95+UWQyV+VDCziEwb:nEkzwHRGWMX6+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1cc28e03353d170ab52dbf4a6b2b0960f6bc66d10fff9d9dffa680de385ebc5a
MD5 6166dc55afc59d4b9c22d6f2cf4fc767
SHA1 b1177ee8963dadbeb5112f3432eb39a366e43c83
SHA512 190e63738881191a76f733cc584732df9819b3a2a81ad999ed6e73620702fbc4beb3a80deaf57747f5fb727d9b61413ff8d3daea69c437e4dae32061d22b9cc4
SSDEEP 96:nEkzbd21dRwpvWMoiVmdeFV7hB2m95+UWQyV+VD7AiEwb:nEkzsHRGWMVV7hB26+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f8f5b68972627cbfc453c35badcf167d4fb7f5cf52726a27e0bf1036345b737b
MD5 a3f13fca209284e36ad400a6a6b62b96
SHA1 aaf2e0af97b1a6c0296ed9d9a635176f7741912d
SHA512 004b6dd677d031d6e7e4d40c084af6eea56ceabcd9031ac6a9fe2da925c9769da8b98e4d412a6d56b088bb379483eca6f9e97685a3010f607fc01665c82009ed
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSe2RUV/lYON/:A9iIxuERzA83h09RZxYs8VN/
MD5 SHA1 SHA512 SSDEEP

Submit Download