b5180001f2d5a7194a51205be90a0123496b718fcb686f7290e1a35d60bfdda9

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38ce98313c86ce1736eaf6cf86ec7fa8_JaffaCakes118.html
Size 38KB
Sample240512-hmfltsdd8s
SHA256 b5180001f2d5a7194a51205be90a0123496b718fcb686f7290e1a35d60bfdda9
MD5 38ce98313c86ce1736eaf6cf86ec7fa8
SHA1 f3a96a3d0418c6aca8a43be7164a9db83b22c014
SHA512 5b2983b3ea829887d13bf1433a0945a617110245704eae25274fd2a7b010e7247b2b29179edfdf6335743f265e4241e200c40c16d63918464a21d0f68c1005a3
SSDEEP 384:Zm0uIJoVNLAYa761dz3mOHAN36mPNKNSv+j0:sdFiN761tFANJv+j0
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
2736	msedge.exe
2736	msedge.exe
532	identity_helper.exe
532	identity_helper.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1736	2736	msedge.exe	82
PID 2736 wrote to memory of 1736	2736	msedge.exe	82
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 3356	2736	msedge.exe	83
PID 2736 wrote to memory of 1832	2736	msedge.exe	84
PID 2736 wrote to memory of 1832	2736	msedge.exe	84
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85
PID 2736 wrote to memory of 2968	2736	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\38ce98313c86ce1736eaf6cf86ec7fa8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd952e46f8,0x7ffd952e4708,0x7ffd952e4718
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18416571125501425122,12997161860421154471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 189B
SHA256 045646bc1a87f1ce57c87ba8a6ed5332e36f71e667ac712be1df2fef80385f8f
MD5 efd079652ad21c50d69ad30ccf61a40d
SHA1 000bc74057bb6ab42d2a160349e1597edb211bc2
SHA512 35f643af8bb12bb445e3e6ce7577376dc69010ddf8d7e76752d703cb50f091bdeb9947b9718baa6e9e286d69df19a794522e446f29d58dc26dfea571045f51ab
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 07d83c8868487a7f58d99b0c00a585e342a0bffa882de78f281f656e60bf248c
MD5 9ccf6453bbcc48510291478e57c01b69
SHA1 edc6b25ed68d8c765077cd743af75ccdf9917c96
SHA512 116d379a15a669afef146edd1e7d83108503681a9258546cd94d45d0f583738ed315639ec350964089835a6dbf5e5b537bc13ef22a4fe1b1855344fd5d93823f
SSDEEP 96:nKkNxm/pQYmqrh1U72wpvWMoiVmdeHk49CCUWQyV+VDCziEwb:nKkOCIh672GWMX3CCro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 090587b2c5f5c67e9a804c3e114b30e52ccf2de6eaf530c1a534f6245a8dd06b
MD5 f6affa70eaf7a9db68c1c2220d9852f0
SHA1 f0bf336683475af6e446b5c56351a8765733be2a
SHA512 27178cadec60addd1886265191ed98949935508fd803c44b1b78a1fa5fc0e502335e4e1902f4e8dca397cd5ca964d3418ea7160cf14eb9f6ba9585b8d4c16020
SSDEEP 96:nKkNxm/p4mqrh1Uv2wpvWMoiVmdeHk49CCUWQyV+VD7AiEwb:nKkOdIh6v2GWMX3CCrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ed2c90c5f8f34e27be8a7148c7f3eb830e3772b20b364232287c4a446a056fc7
MD5 2df2f215cf3f34adbb77f07162960338
SHA1 66dee7028b686d0ef9da6966efc019e6ad09b802
SHA512 89e5fbad1986d90157dceb7df098f6ec56efe102e41cc5470a9f94372514f972ce6e13a2a774ff63aaac34f233228b4bdbe4b00e1ef1bc1a8c92eb81fc326d31
SSDEEP 96:nKkNxm/pnmqrh1U72wpvWMoiVmdeHk49CCUWQyV+VDCAiEwb:nKkOwIh672GWMX3CCrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 a850de3ec9d2674f112fae7be2b6649981214b921e3d409c591451c45e28728c
MD5 68cb607b9a4a858e595ead09c4d73c4f
SHA1 44e394925e6a79998226c606b85dba9347a3d1b7
SHA512 1bad659439c0d5da926565b6d13805b703524e23634235cccd414a9a07356798fdde4f3801bdddf01a799b665d1ab4eb4567eda9c8d243be7ab1e1d1842b9cc7
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d570.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d570.TMP
Size 203B
SHA256 66907fe457e6eaf33d288581f16cdf4dbda919070617f1d1553918b801576d3f
MD5 b02950c13fae3f49aa10ed798a70c4b5
SHA1 22d0b011665ab0fdf42ceed8a8121b31a5fed885
SHA512 b275d456b88959d81b48fed3e880bd50712efdefcc86b412299ca9fe66d61e636df8f44e4b4d2f8a99f7822b227590ed7bac255f868006bc827284233a935bb7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6ae7fee2eebdda4e6bc1819efbcd0d67ca5c09c749cea621ac16fd8153c97fa2
MD5 5037628d6ac53eef3e8a6a89e73224b3
SHA1 993a1ad28a277896258dc9a0d1356584bab1f51e
SHA512 f5e9053d48910c9de009ecc6a30161dead843e9f88fe8260aeb85df83b73fb22c74b301714ede4acea557bb654f4228001a9c635510cc74ccdf4866f5daa6f87
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupM3e2RUwyRVb+OblfBhDaad:A9iIxuERzA83h09RZxYicb/XDafEBTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download