8027d66a616dc904efbd7fe594142a748e953ab8ca0b4bdb62e1eb7a6a07af20

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a72ba6008ca5e9dd90f450db214b37d_JaffaCakes118.html
Size 32KB
Sample240601-pdkbzsca8s
SHA256 8027d66a616dc904efbd7fe594142a748e953ab8ca0b4bdb62e1eb7a6a07af20
MD5 8a72ba6008ca5e9dd90f450db214b37d
SHA1 81e94d372856e616708cc27280df64375a66bf53
SHA512 1ccc87ad6aa84185d5b7da212d79e31c8c753952881b0763e29367b4302da55ee78c512a161a8d490a9e631046822d77a177ae22da7032d0f8d2c45cf5278d27
SSDEEP 384:4b0uuJMSwlKHSaYoZ7xiGp0lTF/+8jua7xiAWH6CKycVBOQJMW3o1oI2AoI2sZR4:WdcHF7j0lhnbJI7j0
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
3576	msedge.exe
3576	msedge.exe
3104	identity_helper.exe
3104	identity_helper.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4788	3576	msedge.exe	83
PID 3576 wrote to memory of 4788	3576	msedge.exe	83
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 2304	3576	msedge.exe	84
PID 3576 wrote to memory of 512	3576	msedge.exe	85
PID 3576 wrote to memory of 512	3576	msedge.exe	85
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86
PID 3576 wrote to memory of 2352	3576	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a72ba6008ca5e9dd90f450db214b37d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d4718
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2392 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,12805858170946275645,14566919931255952716,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 1024KB
SHA256 6b48449adbf6a455baa3f7eecf792ef6775c1450c4d48ed8efa9d9066bfb5afb
MD5 7888c6276cc924fe3fcb577dfd5bf14e
SHA1 88b6a5d3de5857994cebfa494010706d5bc79e9c
SHA512 b2b9db9ed33af2a335eeab3e108f95ca272a2c0edb0d19bc8219bfae825efa733283ba8ca34c40ebcf250b426272ce43f541d3c1699e945565a82df9d97570df
SSDEEP 24576:8EH4ysyYMAnQKnpoODcazlv1tLyKHIlUdIlvRjsQbvB4OX:8EMyYfnQKnp9DvRLpHIl9RjjjfX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 189B
SHA256 045646bc1a87f1ce57c87ba8a6ed5332e36f71e667ac712be1df2fef80385f8f
MD5 efd079652ad21c50d69ad30ccf61a40d
SHA1 000bc74057bb6ab42d2a160349e1597edb211bc2
SHA512 35f643af8bb12bb445e3e6ce7577376dc69010ddf8d7e76752d703cb50f091bdeb9947b9718baa6e9e286d69df19a794522e446f29d58dc26dfea571045f51ab
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6dec8ffd320565e5ecc2447c1916039d2071f14f4b72a90ab067bb7eeb8007b0
MD5 7003db86c345abe0b177c2ffb72b48da
SHA1 47565d4de8a5a53e1c03f0cc6d6faa1eb90582bf
SHA512 cdee0260125cf19f4bdb294a7cb39558fe7b31c6f9a46592ad8fd0bd9a44a63928f03bb24c706137de5be63d8e0296b4ae75df9192c2694b128d79d981aa897a
SSDEEP 96:nKkft1Nyn2wpvWMoiVmdeHk4OUWQyV+VDCziEwb:nKk1Cn2GWMX4ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6d2e965de410be71d0121c4249ed0609fde934a7559054f67bc099f38dc67f07
MD5 dc46b0b95fb468682439744693ad85a4
SHA1 790f04eb52e10d90a3b96c107277316d0a6fddd1
SHA512 f5f7de4e32a0c47b30bb0f795a26064f670e49e3a5b25b45ee22cbc9652df3433e6af6ea20c30b0b608ea1e4f35e504f4bcd321f232abc857b457091ca9f6bfe
SSDEEP 96:nKkWt1Nyn2wpvWMoiVmdeHk4OUWQyV+VDCAiEwb:nKkaCn2GWMX4rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ee1fd10a592f11d2fb2d0afdbd293ea1ed4b1af704b2649ba1a7fde191a9698c
MD5 616b866cfca25c74637ece460cd82236
SHA1 85d28ee559d522b3a287366067fc7a86682b28f6
SHA512 645845f876623e9960e36638a09fdc8906e464785e0ec5620f3346e34eb3543cda9c2cea54438e9c49aab16343f6e8d80b4534a6449d1656dd2ff76339b85b6c
SSDEEP 96:nKkRt1NyX2wpvWMoiVmdeHk4OUWQyV+VD7AiEwb:nKkrCX2GWMX4rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 49c7ae36f01e30d289914df54534aa11cd598700db4b3738046840cf8ab14b2f
MD5 110a2f5046b062e73a996eb14e5c1244
SHA1 64adfd5a8d8cea44b19b75769355af4356eeb1c5
SHA512 ee5b3a556e51243e1f4ccf878d45441f335d584660e953c20ea47f3e16c444f95342ee6c7b5ee371f8dafbf299c657cbf979b72a50a6055c8621709d4bb4884f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57f8d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f8d7.TMP
Size 203B
SHA256 0b3ba1df4b50d6568f92b7336c743008c10d310842cd1211e85f928e2d07bd00
MD5 82e36a5e67543423c7122a256049dc4d
SHA1 a22d03a5f4ba0751a3a38aa222ab1a55736c51c9
SHA512 1bfdc0ca537ccebbf39446853fe8f5862c4e93c9a955a43b13c007dd21d9ca5e8a71e39234063dac0c1a1cdb1eb082df24817af4aefad92f1c3a3941305db329
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 56b70c09b1487e195dede484e87e8a510132fafcd8f11c0c1f8d5cf4314cc6f7
MD5 b0756fca4fae5ed13e8b64c3d766ba0b
SHA1 f7d0779eedc3185725d1dea259463ce381669506
SHA512 5e78425f1281f34a8575c46dc6089547aaa5d5e8b6495ebbc06b0c3a242c7e5749ef92ba939dec58bedbbdea9d091a52e4634a0f3f1a1306cedf07b96c859d6b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8/e2RUKy4V13z2OMDCRHqo:A9iIxuERzA83h09RZxYWd1aOMWRHqlWh
MD5 SHA1 SHA512 SSDEEP

Submit Download