bedf3bdbbeae440e89c41ebf9d855ffa64a1965652c314a6fe621283c398a738

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3dc396962792241b03191bc40afc4f1a_JaffaCakes118.html
Size 33KB
Sample240514-ea7yrshe7s
SHA256 bedf3bdbbeae440e89c41ebf9d855ffa64a1965652c314a6fe621283c398a738
MD5 3dc396962792241b03191bc40afc4f1a
SHA1 50288de47e67e4e71ee0bfeb5cbc487a90a04a6f
SHA512 6bf1e1661b1d9c088766c76415981e279ca293ecb431c1d61c27796a12a2efa534010a263c63fbeeb05d08ff2894ea3a1c46d6a6a66b68dec570b8f3d8de8d3d
SSDEEP 384:mi0uYMMSwlKHSSoZ7yV/2AGp0lTF/+8jua7xiAWH6CKyZV/2/BOQJMWfjMIDMITX:1d1q7x0lhn1JfEj0
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
368	msedge.exe
368	msedge.exe
1188	identity_helper.exe
1188	identity_helper.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4220	368	msedge.exe	82
PID 368 wrote to memory of 4220	368	msedge.exe	82
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 892	368	msedge.exe	83
PID 368 wrote to memory of 4348	368	msedge.exe	84
PID 368 wrote to memory of 4348	368	msedge.exe	84
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85
PID 368 wrote to memory of 920	368	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3dc396962792241b03191bc40afc4f1a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8daf946f8,0x7ff8daf94708,0x7ff8daf94718
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,38726083975467414,13856584848413608019,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
MD5 SHA1 SHA512

Submit Download

9cc6e81c-9c03-4be2-80c5-a5465752315c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9cc6e81c-9c03-4be2-80c5-a5465752315c.tmp
Size 5KB
SHA256 67447381589623047d54f95d04fbfbb1323519c3602b3b88be83d5f211dc4fad
MD5 e30f8e8ef0683665ada6e72d386df2f4
SHA1 0ddc0096d35fcbd2185d38b56936fa83056bd33b
SHA512 2508aea877e4661f5eee3a412c42025f075e097282427ff43519eae8f1a001fe5f67a81876c785b72d7610a4b90d9938d5b8c566558a232e445c2f80d06f8579
SSDEEP 96:nkkHE1ShPe8wpvWMoiVmdeHpw8ENAMUWQyV+VDCziEwb:nkkkMhPe8GWMXpw4Mro
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 832KB
SHA256 2fa3a9ad2a91419b08553cfd87b4ed6d69df76eb1df1e352ef2b0ee5f53e998a
MD5 8d6d0e6f914aaa27b651ab8ad83fd8e3
SHA1 7286f4415695043f775222dee1e87bfef8b0db12
SHA512 bcc9c08bb15f769bb4fdd25ae82ebe2c25841dc43f2cd8715bd16a1cd6bf8617b826c0f9ef8f3def206683229440b0dde84f8f30f84ab2dd2ac22d2386e35700
SSDEEP 24576:8EH4ysyYMAnQKnpoODcazlv1tLyKHIlUdIl8:8EMyYfnQKnp9DvRLpHIlu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 189B
SHA256 045646bc1a87f1ce57c87ba8a6ed5332e36f71e667ac712be1df2fef80385f8f
MD5 efd079652ad21c50d69ad30ccf61a40d
SHA1 000bc74057bb6ab42d2a160349e1597edb211bc2
SHA512 35f643af8bb12bb445e3e6ce7577376dc69010ddf8d7e76752d703cb50f091bdeb9947b9718baa6e9e286d69df19a794522e446f29d58dc26dfea571045f51ab
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d4b0bca61a0d1409648713b00cd391f3757b56f29674205bc3ac87e22f573290
MD5 d3462ae4471cc850d4f5184faad4dc07
SHA1 7a3f4533387fd86d5b62eb8374fa7beae09e263e
SHA512 e340c435514c2e669f0ddb562db40e6b0f3baa39c2e4ec0e962573e43195d5972045b9d21ad70644f6f11156449b78f9e34ddf6e8d6159b978957a711a347627
SSDEEP 96:nkk5E1Sh/e8wpvWMoiVmdeHpw8ENAMUWQyV+VD7AiEwb:nkkuMh/e8GWMXpw4Mrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9857c2681874d6eacb4ee826501d514ee0f5c24fe8f65bc6e86663692bbf5ab0
MD5 b385bc574567640fd909cf83beb6928b
SHA1 49a7e714a847d96c5865ff6faa952e5c1e359491
SHA512 2504f59bf2b688298aedb2734f9e5f6afdba79605270ad8a730a16c31c7611d2a480368aebb324b3c1018a23242afde2a99100957ddb4cdedd060159cdd877f7
SSDEEP 96:nkkeE1ShPe8wpvWMoiVmdeHpw8ENAMUWQyV+VDCAiEwb:nkkTMhPe8GWMXpw4MrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 7f3ed85a3f9bee408ab524640eb6f47869fdfd23c32e7a5e9f3dfa2669d4f826
MD5 76e9b7b77a8b5a73797741243023d144
SHA1 b37a1e9679c8563b876238e9a82c7dfeb95ee41f
SHA512 4dfb355d9398a6208d28388dace4f0b08c46a3503fcf3f5e59c869bfd74db9af954c227baa002c54810f55246de5d2b3692a9962d2640a828aa04a25651c90cb
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c2b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c2b4.TMP
Size 203B
SHA256 d8472041224392c6668660ea0fa4e4bdf1b93895bf23b5551d573d5f591edb02
MD5 f450da07c480eb45fa14688d2f6789fe
SHA1 cdde20b3f8ce6e2a9e53df4e60d8bf0484070c6c
SHA512 95894573e13a4ab31ad8c54d9f0e02f38ca050d25af223a4be9583b2afc3df6ded78201a2b6abcc767d7ccaf745a3da8e7b2b065b0765d671ee76942f693f33b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 925bc8911a5211fc0412d574fd204c5b40accf2e42df03b0f8c0b39bec336dc5
MD5 c9172f6be2450e80abf8a866e4e93674
SHA1 e6442872db26986eba3542deb97af81f69c0b046
SHA512 8f4de8aefb11a00ef5552296c112257ed3ac15091a5eee49024a3c3dc4d5ca2e5d263fb71e4a6e10e8ff92ace7d9d87144c57e2c7ece4522c602c8beb7de822a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQMfe2RUzJ+kd+OblfBhDad:A9iIxuERzA83h09RZxYX4d/XDafEBqr
MD5 SHA1 SHA512 SSDEEP

Submit Download