78d599332a26a1a9049c83aa385cf8acf96cee16945d4657a4182dc7ec53dd8a

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3cf1e9fb0c876829cf2369d2d0ada6b_JaffaCakes118.html
Size 32KB
Sample240916-cfvvaatgnm
SHA256 78d599332a26a1a9049c83aa385cf8acf96cee16945d4657a4182dc7ec53dd8a
MD5 e3cf1e9fb0c876829cf2369d2d0ada6b
SHA1 bdc188b9178d1d8847e91e08f95d29407ca305e1
SHA512 d2732c310b73ba91ca23295ea0d6b73618166f73079f7e57d8c7f5dc1975d63ad0a8a4933f4dc112cf181c65b7392fdb85dbe5be881c9149502e33897fa013e0
SSDEEP 384:2b0uuJMSwlKHSamoZ7xiGp0lTF/+8jua7xiAWH6CKycVBOQJMWdXIZIRdj0:4dcHD7j0lhnbJFdj0
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
4004	msedge.exe
4004	msedge.exe
220	identity_helper.exe
220	identity_helper.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 1848	4004	msedge.exe	82
PID 4004 wrote to memory of 1848	4004	msedge.exe	82
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 2636	4004	msedge.exe	83
PID 4004 wrote to memory of 3664	4004	msedge.exe	84
PID 4004 wrote to memory of 3664	4004	msedge.exe	84
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85
PID 4004 wrote to memory of 5064	4004	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e3cf1e9fb0c876829cf2369d2d0ada6b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3f7f46f8,0x7ffa3f7f4708,0x7ffa3f7f4718
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7040491079578386311,3325764268606209860,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4932 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 1024KB
SHA256 6b48449adbf6a455baa3f7eecf792ef6775c1450c4d48ed8efa9d9066bfb5afb
MD5 7888c6276cc924fe3fcb577dfd5bf14e
SHA1 88b6a5d3de5857994cebfa494010706d5bc79e9c
SHA512 b2b9db9ed33af2a335eeab3e108f95ca272a2c0edb0d19bc8219bfae825efa733283ba8ca34c40ebcf250b426272ce43f541d3c1699e945565a82df9d97570df
SSDEEP 24576:8EH4ysyYMAnQKnpoODcazlv1tLyKHIlUdIlvRjsQbvB4OX:8EMyYfnQKnp9DvRLpHIl9RjjjfX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 189B
SHA256 045646bc1a87f1ce57c87ba8a6ed5332e36f71e667ac712be1df2fef80385f8f
MD5 efd079652ad21c50d69ad30ccf61a40d
SHA1 000bc74057bb6ab42d2a160349e1597edb211bc2
SHA512 35f643af8bb12bb445e3e6ce7577376dc69010ddf8d7e76752d703cb50f091bdeb9947b9718baa6e9e286d69df19a794522e446f29d58dc26dfea571045f51ab
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fdbf429c2f5ddff2412e864677da59acb919c76792a528eb92ab16951b0f6896
MD5 127d55b181ba0245f10970e60a0fa4e2
SHA1 dfb4bdd3c31a89a06da3a55c647a775a275042e5
SHA512 291885c411f4d1abd63017eea7b65bb3e4c4cddc722b0ccddc69c8e89dc68c099342d3541fcbeb7a957cd297e1e49a4cacb6d5992e4404919513abfd19b8cb97
SSDEEP 96:n9Akz0IW1AkdwpvWMoiVmdeH/ddpUWQyV+VDCziEwb:n9Akzs+CGWMX1jro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 97a9222549831e8d570fd24768c06de9aa4dfa04eed9c7b7fd76b2e85800b6f0
MD5 94aaf1d6b167af8c4e52c3e52b7b2e8c
SHA1 a89ef4a280cd13065b16e6a279039da094fcd350
SHA512 c75d01e23dce07a8de16f59295f03cbd0d923a60c6beaf798888868fc3b5a3552a6e68dcce465eb00fc6d9af9f06fca4cef01622cbdaa052e49e074b599077ad
SSDEEP 96:n9Akz9IW1AUdwpvWMoiVmdeH/ddpUWQyV+VD7AiEwb:n9AkzL+SGWMX1jrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 975b65e4a88221a72f89714eedb51c35b3806cf7b39e906f18120b27a4aaa53a
MD5 8bec438f74819ccaf55890eced9c4451
SHA1 7dd1a31accb448229acbcf2762d016ace31f3eb3
SHA512 c39f1a11143590333b30b5553498c1a47a0edc38edc1baa337a0ccb835d41e98e7e289b3f6cf3ed4098b365f29e173fc3c9fae0603738f74d9b783dd42159ff3
SSDEEP 96:n9AkzeIW1AkdwpvWMoiVmdeH/ddpUWQyV+VDCAiEwb:n9Akz++CGWMX1jrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 bf010410f6d466f83e7ca7c6cc5cc75f52d79e7f4dc4a7959ba145672e702594
MD5 2ce425f317c810f10bf02c77d23a8779
SHA1 ad76fa360aade59492ead9f8b18b5915fbb6202c
SHA512 228bb4b0a16aaef574659522b47db272c17ee02d56ba5da0ad12ea9ce3206bb10401cb6981026ee65834267b9d80eef5883d9ab71e1ea8adbf48568144e5be79
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe584b0e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584b0e.TMP
Size 203B
SHA256 217749bdf4e7735a89fc992aa5d0d56eca91d9f6f8c34258de3fd13d362b849b
MD5 d21bd16ae954a36eb0b7c3813c43e974
SHA1 18e40c6be4eae11a2a9c26c642953ff44d385c2d
SHA512 86aa0ec7afab9e57240e709d6e6f4551c4124cefdb43ef40b8d1e60307c67b23464416852eb570e6f52737a63357eb2a59862c8ad897d2b8e8661d4209374d8c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 59aeb7747334bf62bb005539db88adf39a040b6dcaa60e92257cd5aa19b62981
MD5 3c01d39ec95539271a064cd0de65d322
SHA1 fb4d6a3dbc1b520aae9d2ef874c67bc538829e28
SHA512 d2809e24e94a20b14b050454a1bb71b3d6005f3ee998a835199df99e2a12e6c06d757d79fee045ab905640889aa96fdd898dea85af6855f8d2b63f5bdc047d87
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7Ee2RUOs23IpTeuLJ5cm6j:A9iIxuERzA83h09RZxY29Yp7JCZj
MD5 SHA1 SHA512 SSDEEP

Submit Download