bd3ca38a90a213b167307436f7ae20950a00440897b05090b5ead8c775254010

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d40004044188ee87d72fd0abf1ee346_JaffaCakes118.html
Size 57KB
Sample241013-cq7ltsthld
SHA256 bd3ca38a90a213b167307436f7ae20950a00440897b05090b5ead8c775254010
MD5 3d40004044188ee87d72fd0abf1ee346
SHA1 4ecdd399ad114f15d32270ad892dd11b10d72bc5
SHA512 32f10c6694705c899197a811b7f5fcb8878efb32c172164e76a1fa48ecfb423a93f03cd334a98db60e5df3fac0cab38f07da6daadfd94275d802fb2fa4cea0e5
SSDEEP 1536:gQZBCCOdZ0IxCYiCZRVLwAeBwwrotEn6+cqdRN3HL8u/YDnUz6W5SW0rrmZvaT+M:gk2P0IxhZRVLwAeBwootEn6+cqdRN3Hq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
5036	msedge.exe
5036	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3252	5036	msedge.exe	83
PID 5036 wrote to memory of 3252	5036	msedge.exe	83
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1440	5036	msedge.exe	85
PID 5036 wrote to memory of 1244	5036	msedge.exe	86
PID 5036 wrote to memory of 1244	5036	msedge.exe	86
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87
PID 5036 wrote to memory of 836	5036	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3d40004044188ee87d72fd0abf1ee346_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0ac646f8,0x7fff0ac64708,0x7fff0ac64718
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6301835726513668859,4792447311334777639,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 215KB
SHA256 18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5
MD5 1585c4c0ffdb55b2a4fdc0b0f5c317be
SHA1 aac0e0f12332063c75c690458b2cfe5acb800d0a
SHA512 7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23
SSDEEP 6144:/Hl6MVIiSyiXJeJNmem3pF+U0jBMSrhhH0z1kXEwYR:/kMVTShSNVETSBPVh0z1kXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 a991e1bab36440b5072990ecb59de7210338a73379186f4c6d129f13322ea94c
MD5 4251af76cda2d2a0047e2c0cff0fcf4a
SHA1 c14de3e9c5fe655abe542b5259c54c9c8ab2c706
SHA512 0a42ad6b6bcc16868b3a5c5e5baa26d1de1b1e76a88124a8eabfce4593936251a2486bf05569bbb9717ab3271841bbfe658cc6b896f4f03a92aca0eeb999d189
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 2c0651a316916c5283c7fd88f7bc99eee2e4d6d1d884ac0344b9c9336505ba5e
MD5 e2ea5cf59aada81944234e88f0adeb9f
SHA1 27654c626d9e9ae5207234bb28618d3ae49f056a
SHA512 df804ef82070742fdf957a750cc6106e37d6553abd97010c2e4381e3b23aca842af11bc9e4615f9f0b1082f5b05c2d000960202747f41b2387ca193c6a908d07
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 11af041fd1b392d1371a79b729e588f18757556fad439b11be5cf03ba7229ddd
MD5 1ab2e141bc19c621be16aa8e9097fdc6
SHA1 1aa5568e6d00226960de4c301bb01fef9b20bbe5
SHA512 927aa22c6869543efb49b0e7e7881702659fe61a466cbe0ae0838606c4430b8122a49788f5fba8dbc3698c01a0d162f018148df46d47de0345de59d0dcc0b434
SSDEEP 96:nEkAxm/B6mqr1iCOhwwpvWMoiVmdejGW27y27CkcVUWQyV+VD7AiEwb:nEkx/kA1hwGWMF27y2qVrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d62a1d5c37c9c12cffd395505379e13d433a1f1ecb52ee3e423dc5bb161dfd0b
MD5 8b35807baf8b3ed184d3496665b21f2d
SHA1 a05a458ec3afaa560cb490881979754b67d4aaae
SHA512 7ff7188754d36fd2b6919bc54ee547a0e0600ce6ba6d2e1c640880086a2e12f047cab95951cbf9a8581b5c03ad6ea161e259bb4a9def2f71a4ad97c17e60e545
SSDEEP 96:nEkAxm/BQYmqr1ixwwpvWMoiVmdeH7CkcVUWQyV+VDCziEwb:nEkxKkAxwGWMXqVro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7b27e71c912277bb7fe7b76cc5c3be5dee6efec5cfbd1f8b8f18d6e000a789f1
MD5 332b9b98276e91b6a89ae146b9eb2fc0
SHA1 115dbea9481f0b7ea6863e07daa9da317c2027de
SHA512 c7c0be51e538268f56198943bcd49803749453c7a22f3bee676766e5c73bf61b055acf80e95051dacdc7e94f3f7d10e0c2a5c37d3c0db276ea5f7cb619432d51
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupdNr5zte2RUkb/4nDn6+B1y:A9iIxuERzA83h09RZxYdNr5zplbmtbEd
MD5 SHA1 SHA512 SSDEEP

Submit Download