b21cd1cc4c36a63e92165ae4f775f66c88cd61773626b39a7522ee3e29e0e579

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87e181b59bcb62d3b231e5636c9e7a83_JaffaCakes118.html
Size 10KB
Sample240531-wtk2sahb38
SHA256 b21cd1cc4c36a63e92165ae4f775f66c88cd61773626b39a7522ee3e29e0e579
MD5 87e181b59bcb62d3b231e5636c9e7a83
SHA1 d1507311dc1bf06d5adb853676b5821f57b137c9
SHA512 79039ddd6870243ba141eb82f018d06409f45f222383e7468477914d340f87367db52c004562c1b86d89a56a38db0c3afebfca491267cecb7df2f6200c43a447
SSDEEP 192:DmdBC9vF8vLhQhm/9Ia62n2z2l/YLCz0I0zR:DrSlOm/xnu4yR
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
4212	msedge.exe
4212	msedge.exe
4076	identity_helper.exe
4076	identity_helper.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4640	4212	msedge.exe	82
PID 4212 wrote to memory of 4640	4212	msedge.exe	82
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 1432	4212	msedge.exe	83
PID 4212 wrote to memory of 3564	4212	msedge.exe	84
PID 4212 wrote to memory of 3564	4212	msedge.exe	84
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85
PID 4212 wrote to memory of 1860	4212	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\87e181b59bcb62d3b231e5636c9e7a83_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7046f8,0x7ffa9e704708,0x7ffa9e704718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4614881524273814101,17247006784035792036,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1332 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 3c9d6845679ab49f5890a8cce6b008f99604cd2c872293c9c71ba0037767cc5a
MD5 3498e6ff3a2b636bdfe72d3e496bdaec
SHA1 f8185dd07615d04006c869f4dc117caf924c11f7
SHA512 b6a225f08dce9ab86cff962959bec0fe15f6a54201afb05c3f2fabe7e21e2708ff86012ee3042cbee45b03e0c7951c3780c027c6d90367213c6bf34603522ff2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 7c1d46b5c77fd600bfc6406b4e43bfd081d6e7bb215fb0dcde463b783a114796
MD5 f3306f451e4e17dd7818ec03e332454f
SHA1 e77b1fa4ebd49fa41a88a4b63c05971439faae29
SHA512 e5f5def2ec57e276295a7fdfe264029a73e9d1cbe049d736f01404adfecc680fd65ea176a1f89a809dbc6494824c6e8f129c7c88ff103cab89138ee713a111c6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 c33f9d2b310d9de8fb07fe9ee49ff6e020273786952c285b21e1ccbb46bf707f
MD5 c6496b0495a9729c6a4e7be71b109bf5
SHA1 c94bbeb0fb46fc7082391a5b200fb77d1d647364
SHA512 b93e637a663ccf1d34131cc8f6b1a46180e8c69d4fcd93f4bb1d77c3d2bb3fc1ff78183529d985ca5bd9127df86d2dc0680107c8999a3a962887454d12ff0f6f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6319561dad55eb066575721f67e7963d2a1adc79543193cd74e6365a72b5848c
MD5 c9ca934cb9e1a3809e89a432cbcd91c0
SHA1 bb8128fbdea74b818d087fd077a9a2a22502a81a
SHA512 b9f8baa0e3e6a73bb8d275fc28f167141719751bad0e95aede3fe2333b401769834f589916361750a5f5f250ebac48a2f2125d8def1ac80da1e543d246150740
SSDEEP 96:n6kXY1qhXwpvWMoiVmdeaIezEgErq2m0yUWQyV+VD7AiEwb:n6kIAhXGWM9eYgErq2mrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 df291abcdcb5191ed541d32669265b42fb019fca07b5eac7138e6995ca6ab307
MD5 2cd26f6d302f229c71305cd3af087fd3
SHA1 9f0806544a5ed827fe357dd6ab13fa052209d342
SHA512 d386f321a6b8db656c87ef32873d1c03aa19ce69a1c736091fdd38cc2af0642f94937dc70a719192f2b82420e28f5469e7f0ba236d5ec8ddd8cf34362dfe57c5
SSDEEP 96:n6ksY1qhhwpvWMoiVmdeHm0yUWQyV+VDCziEwb:n6k9AhhGWMXmro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c574b6ed17e02c7e88eb7f6f10bc5ab347cf5d902564ef22e76ce19df7bb86a1
MD5 d21536ec1f26c3915097144ec4d1ae9f
SHA1 f9974731978219088e4e899b589349fb4204f4e5
SHA512 08f75091f723fad4767b91257b42274e5979709b9a5c871a6b8eb86c8aca8662068d914959443080621203b1ded9c60d5425d940fe61903c8b3cdd6d33b800b2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZwe2RUW/ez83z2OMDCRHqv:A9iIxuERzA83h09RZxY4bo8aOMWRHqlh
MD5 SHA1 SHA512 SSDEEP

Submit Download