3c961ee81cce2c43c4c960f0320aa9ab72addcc09bf1681ee129ad7e741f48b7

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2024, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e532318e9a2b5985a33af23f1f1262ad_JaffaCakes118.html
Size 32KB
Sample240916-vct3paydng
SHA256 3c961ee81cce2c43c4c960f0320aa9ab72addcc09bf1681ee129ad7e741f48b7
MD5 e532318e9a2b5985a33af23f1f1262ad
SHA1 3ebdc4708cc44703341d0236def979ca7bd3d731
SHA512 06d014f8b5728e3369fa9c935373044b5f153a189dc622b4e49ccac27492492f1cc13afdd8bdab01d476e10e33f46d7a4a3b8a9d16ef8d2ae7b334e111a0557b
SSDEEP 384:zb0uuJMSwlKHSauoZ7xiGp0lTF/+8jua7xiAWH6CKycVBOQJMWNQIZIEpj0:3dcHr7j0lhnbJhpj0
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3116	msedge.exe
3116	msedge.exe
1840	identity_helper.exe
1840	identity_helper.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 1228	3116	msedge.exe	82
PID 3116 wrote to memory of 1228	3116	msedge.exe	82
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 4788	3116	msedge.exe	83
PID 3116 wrote to memory of 3364	3116	msedge.exe	84
PID 3116 wrote to memory of 3364	3116	msedge.exe	84
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85
PID 3116 wrote to memory of 1784	3116	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e532318e9a2b5985a33af23f1f1262ad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffdef0446f8,0x7ffdef044708,0x7ffdef044718
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12051327457532841032,3020280841827673271,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 1024KB
SHA256 6b48449adbf6a455baa3f7eecf792ef6775c1450c4d48ed8efa9d9066bfb5afb
MD5 7888c6276cc924fe3fcb577dfd5bf14e
SHA1 88b6a5d3de5857994cebfa494010706d5bc79e9c
SHA512 b2b9db9ed33af2a335eeab3e108f95ca272a2c0edb0d19bc8219bfae825efa733283ba8ca34c40ebcf250b426272ce43f541d3c1699e945565a82df9d97570df
SSDEEP 24576:8EH4ysyYMAnQKnpoODcazlv1tLyKHIlUdIlvRjsQbvB4OX:8EMyYfnQKnp9DvRLpHIl9RjjjfX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 189B
SHA256 045646bc1a87f1ce57c87ba8a6ed5332e36f71e667ac712be1df2fef80385f8f
MD5 efd079652ad21c50d69ad30ccf61a40d
SHA1 000bc74057bb6ab42d2a160349e1597edb211bc2
SHA512 35f643af8bb12bb445e3e6ce7577376dc69010ddf8d7e76752d703cb50f091bdeb9947b9718baa6e9e286d69df19a794522e446f29d58dc26dfea571045f51ab
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 7df7e9cbe5b12fbca2c281b1a6108315f27d14924d0ba6b33c3440a137521800
MD5 6280b02354cd07fe5d8122db95a3cbf4
SHA1 ca60f31a0265934e956084810ea79fb72b58d03b
SHA512 6e51096848316748ad8247b74e4717425d34ef1e4f8027ba977f015d10e026c1accaa9c4c060aba3c27984a75b3b5b84f94cd843fa12f14e0f8eb02b41422281
SSDEEP 96:nQk/0Z1wvTNwpvWMoiVmdeH44YA1wUWQyV+VDCziEwb:nQk/k+hGWMX4+wro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b01a7606a8d3c08a84e7f48a573d0041e292ddb1fe06fbbf37954f6cb0c0ad82
MD5 fa9998bc496eeeba6e28d2cbfe627f7f
SHA1 4fc0df1797017bb19e1eff9116c83447d16595bd
SHA512 322cdc6596654ab628b9e16e128e27e6ffbffa2b0c5f21757b28cf9d95357ed59a8ab215d2c86fe46839481a24b96b6e466022b8401bb6405b89a4febdbc6573
SSDEEP 96:nQk/eZ1wvTNwpvWMoiVmdeH44YA1wUWQyV+VDCAiEwb:nQk/O+hGWMX4+wrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6b371a5f34235acdcc42451f58cc606deaddc697741d3aa2e0668a57fff609f6
MD5 e271cd87f2fbc19e942c9561f7470dfe
SHA1 96e819c1e34a46a14e5c9fa48391b21ff4a917f6
SHA512 314a36ac40162ae4b8ff7dfaec78c4cd1cf03e69abe4a586b4278ce38e86e6d4244099e1f19e2286cc9c399283748dc11330aea209fc9f106951c9d250d50501
SSDEEP 96:nQk/9Z1wnTNwpvWMoiVmdeH44YA1wUWQyV+VD7AiEwb:nQk/f+ZGWMX4+wrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 e322239a61120aee8bf9e6deba5fea0442902e912171c05f28abdd93ece379dd
MD5 55cffa88838752e16998037a1c0dd3f4
SHA1 35b1114458747a0d00e55911f6047721892dac1f
SHA512 69e2befda779a8e058bdf0acdcc8155fa900bb439521d3026e7ea2d68ffa5435b977f1f3ce9a300e7551a959d6f1c935dab5fe1dbde1a64d660c66a9cee9889d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581623.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581623.TMP
Size 203B
SHA256 a9fa05b20408d29a810fa88e93b5ca665818ee46514a0b2eb64fbbd0f3b689fb
MD5 ead46ba8761bf3be11049762cb5f50fb
SHA1 289ca70621a48b2b629b687871054df714931251
SHA512 9a78cfb66efedfe50c73265d8be57c5e7a4c9f69cc8a7049f91c1e8e48b031d9e37914e12ec2b158938ba13257102ed539a90a713f3878c93c2280229b850ff9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b65498ab605dbd19ab284b1db56986427a6f5baacc204e2374802e77dae67f04
MD5 e664423de2fde6c749527ef1a67ec608
SHA1 4272aa4a0662a9f08471242fc85d22de16b3ae9c
SHA512 472e557cc802fd4a095f112184dea443e903e6b7a085dd19c0e466f919b7b63bc48800d66e04b50490a0b619c4b53ad36dd8e81d9aaa275f9065b2d52604582f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupue2RUjOkrTeuLJ5cm5K:A9iIxuERzA83h09RZxYwCr7JCgK
MD5 SHA1 SHA512 SSDEEP

Submit Download