a96d9e3bf3752ce2c55d4eef77a39b83f2e1452b467df7489971abb4af49e023

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4c750496505c32f01dd84946325ce72_JaffaCakes118.html
Size 139KB
Sample241126-3thd8asmhn
SHA256 a96d9e3bf3752ce2c55d4eef77a39b83f2e1452b467df7489971abb4af49e023
MD5 a4c750496505c32f01dd84946325ce72
SHA1 fcb00d95add6950e79aec6dea8eb271d063082de
SHA512 42a5c1353f40b24813740a2353bb1a006071d2d577e3847f8457c94449457491cb060d256cb7a0c8f9cfee20a6e94b3424271a07d037461027b406fdb6ced33c
SSDEEP 3072:SGF07SP3wCqbIrqbIVgvuyoLsec9tIINwM31bs5FWTN5ycpzP:N0+43IIIWwM3h
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
1184	msedge.exe
1184	msedge.exe
2280	identity_helper.exe
2280	identity_helper.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 3748	1184	msedge.exe	83
PID 1184 wrote to memory of 3748	1184	msedge.exe	83
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 5112	1184	msedge.exe	84
PID 1184 wrote to memory of 4276	1184	msedge.exe	85
PID 1184 wrote to memory of 4276	1184	msedge.exe	85
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86
PID 1184 wrote to memory of 1236	1184	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a4c750496505c32f01dd84946325ce72_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad15346f8,0x7ffad1534708,0x7ffad1534718
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3043881490787005016,14821951554746515774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
MD5 8749e21d9d0a17dac32d5aa2027f7a75
SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
MD5 34d2c4f40f47672ecdf6f66fea242f4a
SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 f4934ae0b20dc3277a9a2cb320c08be8acbce448604974c25d4777be163f234d
MD5 d43207a90e7107e51343f445807df896
SHA1 90370f1dac7b3ae57166f08f65ecfe95b18890d3
SHA512 afa4891352e0243e9c9684d4cf5afa0d1b3bcdc94d6cd53c4b71ab6d47b3b272cb007f51076d5a3896f6122e0797101443d6f9857b714312dbd49aca53257611
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 6e6e033bbc30d6f26b4c38b69c1c729e05389355308c6abdb31e0daee6c0fd48
MD5 6a5d30704ca1aeaaf75886ad3b9b61dd
SHA1 8bd5c05fef0b2be5140b3c6179b1594fe9c7e386
SHA512 020f21872adce77183b0ea6cb666b4d8c0070713440eb3a3a33a67f70b2b57707bb838fe8de59d9e540d371d9d598a1994b52b10c33f780ce209f489697e3c2d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 55cd4e34d64f10988ff44bb44f8808930a03d207d7b6a328b066df590c17ec0b
MD5 e2e72df9fa4a3fc1bd86736ad076f60e
SHA1 888fa593ffb7327a8c85f4ba4e5b49d55bb98180
SHA512 bb67b5564c6618068f577fbb1849f283848035768ea70386b075d5890ddc1dd633367224f595215ef02724e6fca64048c4f954c65ba801afcbe9a41d33e0e60e
SSDEEP 96:nCQkJSA1hiwpvWMoiVmdesHf+4YErt2hO4/LF7mlmUWQyV+VDCAiEwb:nvkFfiGWMSfrdB2cV8rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ce7a4170df227064a119bb85a6e2cb3db92f2c1dc3f8cd3bf457df30ec900812
MD5 b95742715005caa17cf84fb061b1fb5f
SHA1 f47b1629e2eb84fb1b463957672ffce287342e87
SHA512 526bfd1e3d10bef12779bdbd6dc71834de09a0ba16ec5ada279bd55c921b97a4d6e1e3f89bd998028906b6a3fdc0e7f469e42c8d9eb1c5d73be12b9fd0339034
SSDEEP 96:nCQkySA1hHwpvWMoiVmdeHhOM7mlmUWQyV+VDCziEwb:nvkAfHGWMXcX8ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 77f3472ebe848e80210f7b429b2e575df8a9afed1e81df391a5b447f2b68a1e5
MD5 8ac7ab954f7366942ad348f358400899
SHA1 e258bb1985f2b595b17d0dace4f6cc68f74e0cc1
SHA512 a84d5e0ccb9022bc7daad2cbdb5c99ba548c7bc6ffa64c05ed1338d7a11a5b9dae206975a6b5afdcf347d5f5f93ccfeb960a270bbea1f07df72dd01462c6923a
SSDEEP 96:nCQkJSA1hHwpvWMoiVmdesHcErt2hOM7mlmUWQyV+VDCAiEwb:nvkFfHGWMSpB2cX8rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5b8727aff87243e57ca7b837acb9892ff136df479215f786b54d9f0fb4673474
MD5 60aa3031fde8ef159b1726eab72afb85
SHA1 c620425c6590c6279c44d48439018350353d27d2
SHA512 bb7ec9757d551fb0f54043491b22814558dc77156353bb51a52256047f776aee37f03e30b360104017bcf00be4a453330a13f9eefa52e27edfaf63899de6d090
SSDEEP 96:nCQkJSA1hiwpvWMoiVmdesHf+4YErt2hO4/LF7mlmUWQyV+VD7AiEwb:nvkFfiGWMSfrdB2cV8rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 1a872f0dfbea7a0c320ad6273afb87984a45cba5fb248121f468a794fef2753c
MD5 c2bd85f0a9ab1890fdbbcf02d7f8c175
SHA1 12a9abf14f6c1b2f64fd1598b215f54d63b78117
SHA512 0fc9239b0ae6db80763945d0c0d7969f0441425f432eaa4f2b751529aba41729e9bfe9d9166348bd79719f12f1767db73d98e46ef2f002de3c13a1370f048a4d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup280e2RUVIs8YdF980JQwUD:A9iIxuERzA83h09RZxY25y8Yi0Yiu
MD5 SHA1 SHA512 SSDEEP

Submit Download