6c3d6884a1ef8771bfdbe6d16616ea5e65d05f3daf35695acac70bc991d40a75

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41710e4a7f482c1fff7b8d42fedb847d_JaffaCakes118.html
Size 29KB
Sample240514-pcsxqsfb22
SHA256 6c3d6884a1ef8771bfdbe6d16616ea5e65d05f3daf35695acac70bc991d40a75
MD5 41710e4a7f482c1fff7b8d42fedb847d
SHA1 bc77efbfefe4e814f82f3eec1c08d51a13d27979
SHA512 1b58bee45c9047e300991e14463eea05743c1016468c7d2f637672f53988b159c4417d08c77a5c56570dd8744909d6363410d3f6ca9435fe8c273d820538bf31
SSDEEP 384:d0uqVyDgZmdRzaC0NDlxBsQuIJncruQNZNSwljK:ddZQC0nXJN4jK
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
2196	msedge.exe
2196	msedge.exe
1204	identity_helper.exe
1204	identity_helper.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1480	2196	msedge.exe	82
PID 2196 wrote to memory of 1480	2196	msedge.exe	82
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 856	2196	msedge.exe	83
PID 2196 wrote to memory of 4488	2196	msedge.exe	84
PID 2196 wrote to memory of 4488	2196	msedge.exe	84
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85
PID 2196 wrote to memory of 388	2196	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\41710e4a7f482c1fff7b8d42fedb847d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94e46f8,0x7ffae94e4708,0x7ffae94e4718
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,322818531421602435,519317581886124617,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 1024KB
SHA256 6b48449adbf6a455baa3f7eecf792ef6775c1450c4d48ed8efa9d9066bfb5afb
MD5 7888c6276cc924fe3fcb577dfd5bf14e
SHA1 88b6a5d3de5857994cebfa494010706d5bc79e9c
SHA512 b2b9db9ed33af2a335eeab3e108f95ca272a2c0edb0d19bc8219bfae825efa733283ba8ca34c40ebcf250b426272ce43f541d3c1699e945565a82df9d97570df
SSDEEP 24576:8EH4ysyYMAnQKnpoODcazlv1tLyKHIlUdIlvRjsQbvB4OX:8EMyYfnQKnp9DvRLpHIl9RjjjfX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 189B
SHA256 dfecb8fc1fd533663c8d9fe92af9bee8b35c384e4b4bb365c3b0312a8bb2fdba
MD5 6802b48d8b058dd8d9d6256824f96cf0
SHA1 bdb03c2caaee5403b07680ecfea7e6fdb3d0df9c
SHA512 8e130cd610dcdb57469481b77609eff566a7468d57cbf4d501ed13567de981c1b60cc5c73ff20b38d88271dccd31db20f61a318b077842f3931a71a6f203e556
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a46f74d45628fcb4cd6b697a4c6fdb334cf82ace41ae867b9cf233f3c908ff99
MD5 ea1ed0e09b40abd58640f7dce739f9ee
SHA1 24fbce040382241bd127b1d0a6082396cd3a5d6b
SHA512 95f1e6b8409c90c9674078ed1993657dde78815d6082f4cc0536a762c74aab391cdc914a7800dd9e68e983dae4e54dbd2391cf29959b662df4e7be81257f749f
SSDEEP 96:n0k3xm/pQYmqO1X1wpvWMoiVmdeHBrzEBUWQyV+VDCziEwb:n0kcC551GWMXqBro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 45cf7f19c596ae85e2c8ff86baeb97d4529a2a11713a329f4be28cef278ec41b
MD5 006460b7a5dc8d7284acd005d1b68c92
SHA1 2cf8704344bd75f596b40a9b5cc3a56e5817102a
SHA512 8adbf00b6b5b8c502b752251cc9258c7506989f407d699a386b5230958dfb8d41e1cf9712fa7e188f24fc75491a856a36af3c4869186250972c9033039eb215d
SSDEEP 96:n0k3xm/p4mqO1X1wpvWMoiVmdeHBrzEBUWQyV+VD7AiEwb:n0kcd551GWMXqBrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fe2800be6dfb6d44a0dae22d6a6d1a19c0383518e4b305b842a9ae44a5c46a7b
MD5 ced05e4d90c9af48ec6579c9c94dbb96
SHA1 1f6d612e60370cc4b29c54b511853080cbfe0ff5
SHA512 558e2c4adc31f27a0ae27bd90ea7e1d6a5451b154bd0456f07134ecbfe0ae3fb6c489b703c7775cee33035ae07abf9bfaf279f457b0a32b21a6a802f9bf48bb6
SSDEEP 96:n0k3xm/pnmqO1X1wpvWMoiVmdeHBrzEBUWQyV+VDCAiEwb:n0kcw551GWMXqBrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 7361befe224ddcd84a7178f8816c64dea4239c8e5f086f82c1a273ec57e1f251
MD5 52cd31f55380044bde5efe9ff9572195
SHA1 c866c864bfc02a4e43b25715035c423686527002
SHA512 97a2a522877268df5c63cf01bf0cb8dd1721a380c666197e65c3037021c689e34445ed80802d8f0ea0e0438ffba53e24ecf0b90d377ad5d83973ba4c081d074b
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c8af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c8af.TMP
Size 203B
SHA256 fd789fead3509c273f00f2b692b23178ad37af4f6db2a01d3e38413a11b4b8f4
MD5 8becd60ccca2417e99005c291d75d0e8
SHA1 aa4142ceefc80bbfb6a13b9a220a42deaec8368d
SHA512 c7996a9ae6805f903985b566c697d5c5f6c8348f9bb92c45f2bbd7f659e09f9a494eba2145d6e8e3f11a9d0aa4396e8357e1f6b7699c4135db904a1c0629f963
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3f8a237e453d38e71bd2d1f281c6a8dc06cace81a4263a20976bb3537cc19f7c
MD5 eb7f7926cee1965bbddb8d764dd95d6e
SHA1 d8c1e0eee4ea2a42762797dccee3246081292241
SHA512 91a03d12741ccb00e051e3a4e2afe64fe0a8ee9b2f034bf0f833bc7c469df3492a0f36262ad3a6b5a32808f560dc3be930fa1e3cdfc7b007ba9789fae8bc62be
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmHAe2RUgEMC29+OblfBhDC:A9iIxuERzA83h09RZxYmHedvd9/XDafb
MD5 SHA1 SHA512 SSDEEP

Submit Download