3d5017b771e9e8fdac4c63890e2c8281c914d67c9a54264c410fe010405e3121

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1106e6855f87650178265f3b41ef6252_JaffaCakes118.html
Size 21KB
Sample241004-ae5a8atflj
SHA256 3d5017b771e9e8fdac4c63890e2c8281c914d67c9a54264c410fe010405e3121
MD5 1106e6855f87650178265f3b41ef6252
SHA1 42fe0dbed049586b6cd46253ec6263b2b1e20409
SHA512 b971c1273784622478925b42724b12d04e0b849ce3090a0dee58a6fea038f2a1299af9e2cc755d24795b04ee2068b13f2378c18f2f042461b3781e0cddd63dbb
SSDEEP 384:QfRIjUDGO2G9kLL9j9F2OznREldJ11vFlFt9kitZbRJgR5MKxvPH8fhdCjbwkZWX:QfRIjUDGO2G9kLL9j9F2Ozoh4e4RWKxI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
4068	msedge.exe
4068	msedge.exe
1804	identity_helper.exe
1804	identity_helper.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2224	4068	msedge.exe	82
PID 4068 wrote to memory of 2224	4068	msedge.exe	82
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 2328	4068	msedge.exe	83
PID 4068 wrote to memory of 5032	4068	msedge.exe	84
PID 4068 wrote to memory of 5032	4068	msedge.exe	84
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85
PID 4068 wrote to memory of 540	4068	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1106e6855f87650178265f3b41ef6252_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf8ae46f8,0x7ffbf8ae4708,0x7ffbf8ae4718
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15675561801508193819,14743037972650185601,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f5bdb3750696bbc2e18e681bb75b940b535522faa277ab8d0cd111e9dc47bf21
MD5 df2f21259435538b1ae4116d3a340741
SHA1 631d49fb79b6d270b745041555947a7706d269ee
SHA512 210591e8ae3b31b32a48447c22358c545627ed8b144630db5be6a8e9546d211e9fe4d5a334667143104d7ab2167e0fd249fa343b5e87fcff729d2990c7e7b0d7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 842B
SHA256 2b45e914587ffc641fa11540ffe01b6062d3238ac19ddef5bdf254bf131e2c2e
MD5 4272c31bc5dca3eb233123e34c163392
SHA1 c214c9a52bd0a188dde064c0977ec8db3b7de25e
SHA512 fd03ef4f9475e3ebccc69df1f20158638bc5341e6c1a2eb61c94ac7f2137c1c3e23cebcdf2a3a3f2211585243331352c988d7ab845770941e985feb80241e5fa
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 576B
SHA256 8dd51334dbc8dd7ea1baa4e80aa168476bf897db447d3b9037681e8851dd82b7
MD5 71187b68662a8e9640986ba13e4da4c0
SHA1 a8f6e138aab78a30e76a419305c8692695bf0779
SHA512 7648f1c8bef6489d4c87281aff8cf9e818aa1b11d5eff89bceeb88ef3d80a6dd93e66cd6aa99f8093936e4ce347cdd7c9cd85929a336305243679bbc1a9ddc40
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4e8d57ffcaa067ede0098ca15af88fd77b5c2d54ee4973302d26a7947684f14a
MD5 f6277f8019583d5bc31e4558e82bf46c
SHA1 2447580506daa009d004851b2cd8929434bb1793
SHA512 bc0ee8290fd853e2662fc40cff1662f2f79051e0138f4db1e547babbfbc23a676b78c850c6b0d9c7b1ad549dccea385b1ca4a36146fa3afbf384aacb82b4cccb
SSDEEP 96:n5k/TE1OfTNwpvWMoiVmdeLbh244YAFtUWQyV+VDCAiEwb:n5k/goRGWM/h24WrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e98be104fe1cedf53cca0b9b64000fd1ce61ce80e6da731d742354d874251b46
MD5 4c27cf9608b77462d435b40fa4883358
SHA1 8134ce09ae9110697b8635942a775cb8b3eff2c3
SHA512 01b5737c8af9a4f0b9fa99443b133c46e3cff87744fa146b37b2d20955d98b28dfa228dfb4f3c1fc91b5a1c7e3c25083e8b403b049edc84e6c73a5a9fd163a85
SSDEEP 96:n5k/zE1OfTNwpvWMoiVmdeH44YAFtUWQyV+VDCziEwb:n5k/AoRGWMX4Wro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c1c8bec9708d48ec65b79d2fedd7f8f74e2505fa464cecde82bb7d11610c052e
MD5 a6122e3b2bd5a31ed1061582a287daf5
SHA1 b7ac8a744dc4c557e6878790132c76984ee8c39d
SHA512 59866328c2f0f92bce5aa8020658d24a251c916dbc968f702fdafa9cb7c48761794381e2ad2dc2bedc5126c2ae3617ac95244f72762da99d5bb40e9edcfa7c6c
SSDEEP 96:n5k/TE1OrTTNwpvWMoiVmdeLbh244YAFtUWQyV+VDCAiEwb:n5k/gor1GWM/h24WrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 eed03eb9e095c05b4dc58e367687bc8115e0acd945c2b2a51a5e9ae748e65723
MD5 ef4871cab5724981e6bde711336d5cb3
SHA1 5aceb3dcacdeae67c9c93307550c39a109851de2
SHA512 2b1e5176306a9b4e0446cfe32687d22b0d7c7722ab299bd1a267e83800495ceb58111e671cd35e40fcf0e6fcf9850a830b4e39b92226810012a39842d47a7e13
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupje2RUCOkrIcM/bo5Zxd:A9iIxuERzA83h09RZxYzXcqZxd
MD5 SHA1 SHA512 SSDEEP

Submit Download