f9124d93e6053f40a05886a23fe87a0376ea9fd0080d9e990309ac4084020c37

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
475207d8a2224163b1edc57adb27536f_JaffaCakes118.html
Size 33KB
Sample240515-wd7wlscc82
SHA256 f9124d93e6053f40a05886a23fe87a0376ea9fd0080d9e990309ac4084020c37
MD5 475207d8a2224163b1edc57adb27536f
SHA1 18dabfe6719d8307a2cec1fc2150a21bb728fa7c
SHA512 af0c0d6a648a8b9a4daad6ea159aad7023d5abd3ba2c8083edc0aaa0b7ff4b12996f3d883b5a8e9bb3dd8c3c6866aa11a362b0de30cb12853540f20509e364ff
SSDEEP 384:Ri0uYMMSwlKHSSoZ7yV/2AGp0lTF/+8jua7xiAWH6CKyZV/2/BOQJMWlLITIr7j0:od1q7x0lhn1JR7j0
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1488	msedge.exe
1488	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2196	1488	msedge.exe	82
PID 1488 wrote to memory of 2196	1488	msedge.exe	82
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 4748	1488	msedge.exe	83
PID 1488 wrote to memory of 1192	1488	msedge.exe	84
PID 1488 wrote to memory of 1192	1488	msedge.exe	84
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85
PID 1488 wrote to memory of 2592	1488	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\475207d8a2224163b1edc57adb27536f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94e46f8,0x7ffae94e4708,0x7ffae94e4718
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13352374074072276158,18256117696281654202,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 832KB
SHA256 2fa3a9ad2a91419b08553cfd87b4ed6d69df76eb1df1e352ef2b0ee5f53e998a
MD5 8d6d0e6f914aaa27b651ab8ad83fd8e3
SHA1 7286f4415695043f775222dee1e87bfef8b0db12
SHA512 bcc9c08bb15f769bb4fdd25ae82ebe2c25841dc43f2cd8715bd16a1cd6bf8617b826c0f9ef8f3def206683229440b0dde84f8f30f84ab2dd2ac22d2386e35700
SSDEEP 24576:8EH4ysyYMAnQKnpoODcazlv1tLyKHIlUdIl8:8EMyYfnQKnp9DvRLpHIlu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 189B
SHA256 045646bc1a87f1ce57c87ba8a6ed5332e36f71e667ac712be1df2fef80385f8f
MD5 efd079652ad21c50d69ad30ccf61a40d
SHA1 000bc74057bb6ab42d2a160349e1597edb211bc2
SHA512 35f643af8bb12bb445e3e6ce7577376dc69010ddf8d7e76752d703cb50f091bdeb9947b9718baa6e9e286d69df19a794522e446f29d58dc26dfea571045f51ab
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8885e3e3aae3284d75ff22a02412e5e30d85dab259a4fa114d3e2ac9c59f248e
MD5 7a750f5486a74a926da25f199bc200b4
SHA1 585b9642c56ac8491fc3691898406506f981471e
SHA512 f32d61330beb4197ff2cc307027620fc244228d4e273c0a0aac851dd9ac302ad696340578016f6773ec5aff7b1b7b7e441f16a538b34e65bc477e7ecd0695a43
SSDEEP 96:nkk3xm/pQYmqe1r1wpvWMoiVmdeHBrzXXUWQyV+VDCziEwb:nkkcCVJ1GWMXZXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c69ebfd3199abae6567b70cf0168e37ae50b2225d7b2880a134a4f2ef490b8bf
MD5 db7b42426098288faeec6433b8c4fe07
SHA1 3a340c0013ab81ce5a0fa56d928ae94e8764353b
SHA512 24df9ff67826a673a13ea8d9a2b51f069cfd6c31002edbc8d21ddfd2989ccae2221118ca0f37e35882dab4e4af1493f29eff693cbb2042bac84dab6a72c58cfe
SSDEEP 96:nkk3xm/p4mqe1rFwpvWMoiVmdeHBrzXXUWQyV+VD7AiEwb:nkkcdVJFGWMXZXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3c618b1c70fb3fcf6b060262abe731faaa72b42bb020a727e003a10128ceb20c
MD5 67b90cae7ea99c216a4b5efe35437661
SHA1 3fea6c48620372591a47b66d8c6013f921ebe495
SHA512 4825ad88d9c3c5e76fbd20a03a460a11bcaeb90b49edf61c0bee7e7902614701c2b2b07e411e6564aeecd4cdd4018300b51082d665fb383074463d81b97b4c4b
SSDEEP 96:nkk3xm/pnmqe1r1wpvWMoiVmdeHBrzXXUWQyV+VDCAiEwb:nkkcwVJ1GWMXZXrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 4129464e2edbfafae2a56425acac08df6fc0d865831a82e7d370b6d24ec99f50
MD5 3cb5efe5bb3689f669915d6ea70a5a88
SHA1 835417427adccb3a7559870226d441a37afd00dc
SHA512 309a1ef0f8ffa16df17072e35f5fdd1578adcc4792bd6692ead43d8af530fc0ab3f8ab381aa01d7ea9544e913de0ee574aa227c1cab1c718b2e1780c2f6c3df8
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c851.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c851.TMP
Size 203B
SHA256 8bd21353106b33fb6147b6bdf28901ffcb588a295b4c177479ade674f9ee5038
MD5 10dbbde960154c7ae310c003dbcfc3b8
SHA1 f3b02f738eb3e3d85aac653179ef824ddd0ce921
SHA512 9b60beca6c4dfbb351cf6467d0720fe06c708a19fdcd1363a816ca5962dffd640b7dcc21c18d9a9a02d2696e23e624b048a1d28e973fd7dc8bd1766e2980298d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ca7fc070b8ba7672b93ea7825f7a2c389f9cb3bd604c6cea41cff8f1dc9d64b4
MD5 23705d19d8293550240da26ad17c429e
SHA1 7b12cd2a5054baa2679fb7c9aa195d2c754541f5
SHA512 140f34001c1d2aa906bd3a7dafe6d46cb0f9675001c02054afa48a8123367505fa767c7d34d9b5ecb74e141e80047192d511ad76842c1417a079497655011226
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupoHEe2RU2MC2p+OblfBhDao:A9iIxuERzA83h09RZxYoHq0dp/XDafEt
MD5 SHA1 SHA512 SSDEEP

Submit Download