94a2ec4e40c824a6f1f4bd41c6a8fe09e6a2cb6bcd2e162bd9d2012388f6c816

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9237f24691c76647dbdbfba7e0613421_JaffaCakes118.html
Size 476KB
Sample240603-sjalhsbf44
SHA256 94a2ec4e40c824a6f1f4bd41c6a8fe09e6a2cb6bcd2e162bd9d2012388f6c816
MD5 9237f24691c76647dbdbfba7e0613421
SHA1 d86c7de069b39d148e111e82d2ff4d8037d0d12a
SHA512 afc1822f8da847539acc1100212f8809eda043830d62bd33b0055ecfe84a102df173a5d5c2fb1ffe4ceb6f454f75fd933be756fb7809a8b21618df3d2fad3064
SSDEEP 6144:JvyZtWB0dP6xP9Y9w/kIZKMxuLwerG9XN8/:trZxRsnC+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
840	msedge.exe
840	msedge.exe
3708	identity_helper.exe
3708	identity_helper.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe
840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 452	840	msedge.exe	83
PID 840 wrote to memory of 452	840	msedge.exe	83
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 3680	840	msedge.exe	84
PID 840 wrote to memory of 4608	840	msedge.exe	85
PID 840 wrote to memory of 4608	840	msedge.exe	85
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86
PID 840 wrote to memory of 5028	840	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9237f24691c76647dbdbfba7e0613421_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffc5d46f8,0x7ffffc5d4708,0x7ffffc5d4718
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,6832371158756537752,8795338498399840579,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0caf99cf8309341f8319bbc098af3dd7f878954ea5fcdead58d404299a480830
MD5 4f42b42e590f4a30e24314cdd244060f
SHA1 d6275409f94ce15979b2f54c99f37f2ae0b21bcb
SHA512 70481746e62386aa90f4e8ba02e89f34220a0310d33cafa797cc45edc5ce5743a1d91d064663f98fe626b879c7f16bcf28d3cb544071c06fb8c37983a73e0e70
SSDEEP 96:nskM31x73wpvWMoiVmdeHplwtMacv+UWQyV+VDCziEwb:nskq3jGWMXpBXv+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8786ebbb8c02144dc036ce45778ce7db20030aa5c3f1a29e76fe1f26a1bfc49b
MD5 5e023ccf576c1e7f9017100c18dc142d
SHA1 ed03b74f303d7e1bc33f2fc85a2d3a1fdcf9e10d
SHA512 5777cd3210c4ffab4c88ef6a84d8780738ad41b7a87832ffc8134563822349a25174ca304a845cac9bcf571311d0c9f7c72c9970d3b78e5f77612e78b842a8a9
SSDEEP 96:nsk331x73wpvWMoiVmde2VtqplwtMacv+UWQyV+VDCAiEwb:nskH3jGWMG7qpBXv+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9d35a04f26562a1531b480dce4ea4b07c7cd8bcd35232e2c4b129099e4a2ecb5
MD5 cc2fd151fc7f2ea805bf110b985d0078
SHA1 61590cb8da54b5c4ffd4397dd8b0421e26687e2b
SHA512 f438991998dcb6329ec6ea53a97874bcf015990c806eff0fb6a80ca18cc14e213b4507ee2b9cb0d887a8b31765c4ae366c2698ecd716eb4c9ae540226fd3917a
SSDEEP 96:nsk331xp3wpvWMoiVmdeNs1+IVtqplwRMacv+UWQyV+VD7AiEwb:nskH39GWMds1x7qpBXv+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 9dd13143db55e8df42304de3a54210077d7e9616a95178799757ca513974f8ed
MD5 4a4e7378e681f121d2d50fff341f9aad
SHA1 e951f0ca4c7ee6f5a54eaa08082a8486bf81e27c
SHA512 1dcfbec5ad5dc3a69fb186a1087ad06441c03ededd0b03a5f52b3cb069bc92cbabdb05426882c11b70fd3b1ceabc6a0b140493b4d382cff9093f6d07b1a6bd40
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe580d59.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580d59.TMP
Size 201B
SHA256 84475133cf9a5f84cb091d027000e9c483e4b73ef6dfb2e159d20751d99fdc7e
MD5 2a4c8e72c635837cb9773c37b658ae16
SHA1 6de3d6fe5557371c3a020feab55726c534241abb
SHA512 b06e600d1c69b318af9bb57a17f35754cdea22a0f297cd05aca3ed2a252d881641361b6823507ad7f7059375addb59184aa936ab135d82184c837bc8599c4c49
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

fa752308-0967-4394-911f-dc235637a59b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa752308-0967-4394-911f-dc235637a59b.tmp
Size 686B
SHA256 2370b64b456f1571878c28d0bdfc820b69513db037fb89d07c6e66bd7ee5f6b9
MD5 ae0fe87d7eade3460a48e5c0f47beaf3
SHA1 e1f7fc995bed368cacee4fe2691b2f99d0486a18
SHA512 0da2fb4cd9d9d64aaf8825d3e11ef2986b1231a4e623ed31c51442289af1a76ca7ec68eb620a1694c322c10ec44157140f1c7266fb70e84224d0472000f43242
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a665a5b21fca4e7299cfb7894572f26304d58b27a2e2b5ebc6cdb68150250b31
MD5 fda28d31ad1bd7b0375913792a08123b
SHA1 948bf8aacc20207b872737685a3ad31fa645513c
SHA512 0eef3798d0dda20325a08db7528e153af6f083b87217b80b053aaca26eca8cf233f963a209cbb01b62dd5d2b6dab3c25a932bd2b62f1928948ed7b5e5a031ee4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuplYe2RUfc/fZv3z2OMDCRHA:A9iIxuERzA83h09RZxYcAcZvaOMWRHqt
MD5 SHA1 SHA512 SSDEEP

Submit Download