3bcbf928a629ac671059a3da1e11f758a667e5b06fe89b4fe0743fb8b48f59fa

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5a7a14e3eb38835956bb177481920602_JaffaCakes118.html
Size 61KB
Sample241019-dbvt6aveqq
SHA256 3bcbf928a629ac671059a3da1e11f758a667e5b06fe89b4fe0743fb8b48f59fa
MD5 5a7a14e3eb38835956bb177481920602
SHA1 9b21dad30010d15b9244ae7292866e04c54f2bdd
SHA512 690f59d6ec9e6b2ce6fcff447d9ee6380eb3710ac682ec8f13c2732e63d70126fee420bb0c8a0ff3d556ffb40dc0430fcb5afa644f33277886f50f8b09540dfb
SSDEEP 768:xyXP+oK4RhvT+Ouem98CEjPwmdwhPseKxH0F+c3o2SGJ+dtV:xyGr4RVT+Ou198NbwmdUF+c37+dtV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
4008	msedge.exe
4008	msedge.exe
868	identity_helper.exe
868	identity_helper.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 2536	4008	msedge.exe	83
PID 4008 wrote to memory of 2536	4008	msedge.exe	83
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 3972	4008	msedge.exe	84
PID 4008 wrote to memory of 2044	4008	msedge.exe	85
PID 4008 wrote to memory of 2044	4008	msedge.exe	85
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86
PID 4008 wrote to memory of 836	4008	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5a7a14e3eb38835956bb177481920602_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa569546f8,0x7ffa56954708,0x7ffa56954718
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7671020015376828988,1529191805249989857,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
MD5 e55832d7cd7e868a2c087c4c73678018
SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 06dc2641aeb9003e4b53bb5ede55ea2c6d6533a00af62eeb93bfd253b642d920
MD5 e7976f7803068dbfeb9334e252119d47
SHA1 ba7fd1cfdc1331238c55ea956b0fb787b2759211
SHA512 f147b9cab86f35c2e9ffcdeb9b2eb9a1fc5a33b7b4e4d2ac338f94a9cf821cf8c78438ad601676365202d46b7b94a4ce3b2353062d1e4a2c5b7716e27d0af069
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 654790df8c2c51f370e6b52880faf07fa5dae87c5bf253a7c9f2b9779b060825
MD5 8cd196acaaa47ba4c7996c94c143c11e
SHA1 4772d21cfaf5c64bec2ac6ef4c8bad8990d7a1f2
SHA512 26ce7cc290910255458ff7bc7b19ee5c718b8dfe9fa8d617846fb665ff7e0fc1da8b410a8668f2f063dd6923fbc9effb58346b224075eab3a824e09e9f03e36f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9d9a3bd181d3adf6e89764cacedb6d248d94812b712fb50d6f36147d938e87d5
MD5 75a5feb7c3a8475f7e6e122dc896be38
SHA1 a65477b03870ebd414362a8cdd68769d9d3d120d
SHA512 92eef9d324bca375eafd05d6fd4a6cf0e148402aa386394e97dbdc9eda387a9eeef462dd61bf943074514eec0979829ba46442324b309c3768dad7b1bbf9a23c
SSDEEP 96:n+kkF1ccPfkwpvWMoiVmdeHycitUWQyV+VDCziEwb:n+koWcUGWMXIro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1c5a05e8c8c51dc49d840b49274dd03597358cb05c7b3be4ce820b407af136f8
MD5 8dbde8f0dd79116688085fd4ad97ade9
SHA1 fafdc933032ef85579e646343d4019e3ecdfd1b7
SHA512 ec6214fec1f9fad084c66c6079c2348a89c02b67ae6aba30ae73d8076ce2dc3fccb61ef45f422c5f9b051a90373489fc9d516a02146985d6148ae1f9f0c2dc43
SSDEEP 96:n+kuF1cmPfkwpvWMoiVmdeM/CMuLY2ycitUWQyV+VDCAiEwb:n+kSWmUGWM8/CMuLY2IrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2078664262d904c212c7b50fbd186a85adc34f0bcabb60644582faa9123f2abe
MD5 8e677bc4295ee33bd625bb0661ca12d9
SHA1 91191a12f3b2bcf039cb01fd27208380076eeae9
SHA512 8d00d00ceffc997eda7ccd016a0787f978492eba2346134cfdbd2a0658931c0b831f7115a51818a781fd837ce812657df83b38a4a8c0d1eaa406d4506f2748d7
SSDEEP 96:n+kuF1ccPfkwpvWMoiVmdeM/CMuLY2ycitUWQyV+VDCAiEwb:n+kSWcUGWM8/CMuLY2IrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 24e6664cb021d8230476f613fa12400f73feba808d1c2041809332f5c8cb1a67
MD5 b4c42f360adf40223560895449d8fe58
SHA1 a1a32d8f90ed921a433e7d213e6a02d54f5d8677
SHA512 7956074c1fcc73aeb9655a2c56f155a36ca0d1c7e9c29d0dbcef372d136916b06d0fb3081f5a5cb5eafafc55f52eca96d002d938824a9489e9e67f5db8f68bb2
SSDEEP 96:n+kKF1cmPfkwpvWMoiVmdeM/CMuLY2yAitUWQyV+VDCAiEwb:n+kOWmUGWM8/CMuLY2orV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8afd482b774c86bb6c0170d7c2621924f23646bc44166c7976f597f7d86f52c2
MD5 9a70d890cdfa3322aa3a2dad7208952b
SHA1 8b38c32b650e120898dee5784ead94842ed6d3c8
SHA512 ab525a29da1d88ec12e2ad4af2ff79f516ef2405406bd5a0b9b0504cb1299d745c2eb5cdc5386c5ffefab14398f702f37ac81c7f02ac8cb9c7d5202ebe0d6ad9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupU4e2RUWp4z81K3wM6n+XAu:A9iIxuERzA83h09RZxYnIIKyLu
MD5 SHA1 SHA512 SSDEEP

Submit Download