19e9dddf78deb68ddb4bc208c01b4a449e13c07aa9145b8cf8887a69ab8c2ec4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91d7633a9a6a8c7c1a60acbed8b9b93e_JaffaCakes118.html
Size 86KB
Sample240603-p2hhasgd46
SHA256 19e9dddf78deb68ddb4bc208c01b4a449e13c07aa9145b8cf8887a69ab8c2ec4
MD5 91d7633a9a6a8c7c1a60acbed8b9b93e
SHA1 40f410ed4c1c4b6283820982fabcf8f895cb2ebd
SHA512 d3edeea507e25e5b9740e0a5bc70ae68e844ce68ef4922ed91e4a6edcd7e4137ecc9b0027db8cb5e2b3a5928330584af396278b319742e2a48a8752e91f5fad1
SSDEEP 1536:vElJTYrUkTFvVO/RUEB/4fS0/8z1ZlqVUDDkYtxgXGUlZdIc:yGLLfSu8z1txgXGQIc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
3004	msedge.exe
3004	msedge.exe
5016	identity_helper.exe
5016	identity_helper.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1256	3004	msedge.exe	82
PID 3004 wrote to memory of 1256	3004	msedge.exe	82
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 1560	3004	msedge.exe	83
PID 3004 wrote to memory of 2036	3004	msedge.exe	84
PID 3004 wrote to memory of 2036	3004	msedge.exe	84
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85
PID 3004 wrote to memory of 4484	3004	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91d7633a9a6a8c7c1a60acbed8b9b93e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaaf146f8,0x7ffcaaf14708,0x7ffcaaf14718
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6547056265145884176,10706270564141840385,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 507c233e83b33a5d4e2eb7c6c5ffda19c02a372842cae53575c33704438fc011
MD5 91dc1099987783afcbc6b868440e7925
SHA1 88b27163418bb7a62ba990936d506f7a2a6b848f
SHA512 3f65d4632d8adf324971163fb0655b2051d6805b9ef6288dbea977f0848260ab395ca01b73196541e87e39e2c2ba1a6b2a21ba552758c3f5651978609d453053
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 84a7158b7cff9d1d576eafe228a6c047df07ec6065b07cd5e7375794630ec116
MD5 8795adab5d9709b479e968ffbfcb2ac0
SHA1 c5f1ee0103133fa83e56b28cbbb9ffae7bd40a27
SHA512 841f2e136fb3e1bc7615b9a35065c8f1d90cb650b8fd031f80f40f776a1c4d33b280bda369c1c4d812822c634986cd21d635789341792be7be934e1df598d82c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 356c4b6ee1c8c2598174a4b0da3c0d7d48261420a61e919ada2654e3f885ed63
MD5 2f0b548d48e086376aa343e9fd4e6933
SHA1 5b12862de40885f4c666c5c5d4113db4b430b730
SHA512 4da21e15f033fd6cdd26394f91114440a5620df23c0512be13436253a2c0e70644fb95df7c9eb1f660657e9e69dcbd4f37b4f194ba81abc55b810eff95750c1a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 be714cfb2ccf0cf6bb2829c852169df1b4237f56338149bb6b30ce5037be3c39
MD5 0d4a2d81327fd75790995ea8e4bb6c25
SHA1 894dcc142087344046c0a7435ca96be55ca8f45e
SHA512 391c2b4a235e600977fc0467dfc39796141296757274ccda0b73fc539901861f68b0a99f83ed9164c1ec674dcc0601a2b69a6c9fcbfb54290eee49c1d22acd6a
SSDEEP 96:n7lkfLY1qgjuwpvWMoiVmdeHvSSYvMUWQyV+VDCziEwb:n7lkTYwgjuGWMXSvMro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 aa1e1eef13726d734927fb1ba0275cf933484391fccbf31e2aa0dcb9bdd919b7
MD5 c0d7e23928021db07fd601fbf05c7888
SHA1 b78138f245dd5183a2c03573287c7f0a0e049f4d
SHA512 d644014478e5d474bf5da64c521488b552ad089e8c290889b3e431eb60365b8033bcf8a371d32b08d791259e3f64a5f9a03d5d53b6c0619d77397204a1e1c412
SSDEEP 96:n7lkWLY1qgjuwpvWMoiVmde/wjX5Xn8GAD2vSSYvMUWQyV+VDCAiEwb:n7lkOYwgjuGWMYjX5XnmD2SvMrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 140fb6e2e524f74dd31c7b5dccdd67480ad68b03d66830ca731d6443b8a31c31
MD5 2e47dea466c77effc9df478a85c048a5
SHA1 81d293bc3bf18509aaecc05c0ce2c4bc70592683
SHA512 10bdebcc81ef9c82d9459f6420d5d60bb650755efc55ac11af35c3e2652fe03d7754f0c74d5a45f224ebd78b3f68a3abda72d049cb229a0c9c5fb5f21455b464
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXipue2RUoWGRupl3z2OMD3:A9iIxuERzA83h09RZxYywXwplaOMWRHw
MD5 SHA1 SHA512 SSDEEP

Submit Download