8b1ecddcb865c78751f3ff0fbe1d19e2dbddd7dbb231493ffb9226f63baa19ab

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a693b5b480893fc51907deceb1b2b3d_JaffaCakes118.html
Size 69KB
Sample240610-glgbasdf43
SHA256 8b1ecddcb865c78751f3ff0fbe1d19e2dbddd7dbb231493ffb9226f63baa19ab
MD5 9a693b5b480893fc51907deceb1b2b3d
SHA1 3723235fc96aae9b039936fc80c03d2c58d213cb
SHA512 0f3a51647785d2ad94c68da6dc0f90ef32898be0e4c613ad774b4d53baaa72af1ef4d8effca44426600df6ea358fb629e17fca0d7ecc39088a8b420177e41629
SSDEEP 1536:nI64+w0tjId0xRJRd5BDyB23uQ0Fo25PuDPGkQoKvrZaaauxrOu:c0tEC4F0/QoKvrZaaauxrOu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
1172	msedge.exe
1172	msedge.exe
2260	identity_helper.exe
2260	identity_helper.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 4960	1172	msedge.exe	81
PID 1172 wrote to memory of 4960	1172	msedge.exe	81
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2324	1172	msedge.exe	82
PID 1172 wrote to memory of 2536	1172	msedge.exe	83
PID 1172 wrote to memory of 2536	1172	msedge.exe	83
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84
PID 1172 wrote to memory of 1444	1172	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9a693b5b480893fc51907deceb1b2b3d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0aba46f8,0x7fff0aba4708,0x7fff0aba4718
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15695173270265328656,798915865486152662,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 327B
SHA256 f30f13b753dded62df4497111e96f41205efe68dd63bf7db055a04b1190ec90b
MD5 9cdc9f7a659f3de038e58f61f6deb164
SHA1 f9833aa320709c2a08f880e5edd200fe2e7a260b
SHA512 569cad516f712340d83e384fa7fa403f6c4b2c70afb59bb2f10c73019b166d4b2a88ba1f0cddcc1c00c857bf4f8136a14d6dc399734e98b20bfb527bdf6b4896
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 43ae35fd804c6c4506d41709318b1419e8f1eb15a49505959e6c45c7df6e2423
MD5 a2bebf5070a4f5f761bc6e30b03f644c
SHA1 9ec588f03f2341813098bfcd36b92018a1d0b0ab
SHA512 07bf2790038ebe8a9a3214f693fbcc3dbc6a5beb49b6d2d7a13e4bafd7091bdabfe476b433db1982321a1aa06bfe378a4c063901f2c1f8da6694edcc6a2a0966
SSDEEP 96:nNkD/1L1wpvWMoiVmdeHBrzZUWQyV+VDCziEwb:nNkL91GWMXXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 935083c7a7d0bd464d42a044101bb96fddc34a2994e745bb0284475be58eec35
MD5 4738b453aa145a000d8ef45f1447d095
SHA1 f59960910441592f85ffd74a722a977134878d61
SHA512 cbcdede3de6c927bc944a7ba6532a2bf63f795ebffeadabe744b01b53381a1699b393b4e53bc9c65c0a8d07899c3a6dec1eca69639fea467b1049d42a50b3159
SSDEEP 96:nNk6/1L1wpvWMoiVmdeJzq2BrzZUWQyV+VDCAiEwb:nNko91GWMRq2XrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4d8187a429ac836ba6df0e4c4bc77ce64121a07a389278c9d2559b0dde09986a
MD5 f20611702c136dd3f0ba680e29302226
SHA1 013fcfffd6998e5c35ea0282cafeb0c52413dda1
SHA512 07ffa96d5bcd64419cac86725a6f8274cd5c5486118b718957ad25c585c99ede5ea76dde3aa841d0133c5da71fd484aa0827b1362d77f0426c4fa54890041c15
SSDEEP 96:nNk6/1LswpvWMoiVmdeJzq2BrzZUWQyV+VDCAiEwb:nNko9sGWMRq2XrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 372B
SHA256 ccfc74eee662d1cbf4ccca163d1334f768e5a330cfd99b54b3075018a6a44ed6
MD5 ec89b5fd9d72412a87fb0e309f5027a1
SHA1 8df0f0c4429b4bcea360675650ed8123d26e5fe3
SHA512 20dfbd7d2bc8ba28c2efc607b375af9490adee4c3fc9d5992dc8abed893df495dc8d2a0b0e01719849d33601d8be6c3e0a1d6e0ed31fd2b807ea4a8c46bfac57
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 372B
SHA256 67b9cbdb03e816e4d045f33b230507e933758b7723d5a1fc8ec879e9338d373b
MD5 0b0db747d38d5f88e836303ff3848026
SHA1 ccbfc120faeb0ff27d0540dc22bd7b2872cd7251
SHA512 ced9abbf5e79bba88d3fa52baa91da9588f075d5b22a5fc6e739ba08876aaaa33d4b3fa5cafb0ed0ad7e9faab874040c4fd0826a1986b01e5b0ba510c0e8a62a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c6ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c6ea.TMP
Size 372B
SHA256 686df03c12457554acd2d88e221e60c865ce78a8eb19fe4195936d0ac58a1bf5
MD5 a060cdcb138e49a42fbb9e2846e43c60
SHA1 8c7392c395e8fa6d6d95e18ee4adfb0df70e99c1
SHA512 bba3f7419ac7b84daffc88dabb419c3dccf49fcf5df1be5ca9cc870020afd98ee7c7aaa617679b4474f5d2a9ccdf2910c4814a5dc7de7105d1bbe7d9db9d46ec
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c503541f793ef866781c1974c2f7e03125baac0470d83a37212a0dcc443507ef
MD5 ffca7df9bf52385ba14389c3e887eb25
SHA1 55ec987362a8d18a30577505d414a8c17edf6d77
SHA512 06c8d15d88f35ee12d269d83cb406f2b05fa2d4324a50567c257d97f563af9cf7290a31f3b6e08632a9fadf01bb94664463b53c5c6500286e91bf767a32b0483
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyH4e2RUMMj2k3z2OMDCRHi:A9iIxuERzA83h09RZxYyH2+ykaOMWRHi
MD5 SHA1 SHA512 SSDEEP

Submit Download