924daa684d7cccec4b1d5b32ca294690d6a929ffe11832d764de992ac01d1361

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0063d44ef31856f9f766340ed5efe5d6_JaffaCakes118.html
Size 60KB
Sample240426-kh694ach37
SHA256 924daa684d7cccec4b1d5b32ca294690d6a929ffe11832d764de992ac01d1361
MD5 0063d44ef31856f9f766340ed5efe5d6
SHA1 66a1749bb8c1820557b29e77938f9eca8fb69fbc
SHA512 b6e863d0ccf490156796d18f18c3ea20b2583a5a232e7ea040a88ad5d7290a91d7e0b941d5905a03bb873d355bbbab21fe269336315d782759bd2539259f9d7f
SSDEEP 1536:UvGfC1A/rGrpAC2BxpstGtlxJVkOI66sjvjTYP1l2jYWM:UvGfC1A/rGrpAC2BxpstGtlxJVkOIGjA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
3516	msedge.exe
3516	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 2212	3516	msedge.exe	86
PID 3516 wrote to memory of 2212	3516	msedge.exe	86
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 3312	3516	msedge.exe	87
PID 3516 wrote to memory of 1244	3516	msedge.exe	88
PID 3516 wrote to memory of 1244	3516	msedge.exe	88
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89
PID 3516 wrote to memory of 4036	3516	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0063d44ef31856f9f766340ed5efe5d6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa377e46f8,0x7ffa377e4708,0x7ffa377e4718
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1005696573935891365,1832078586653857649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0
MD5 120a75f233314ba1fe34e9d6c09f30b9
SHA1 a9f92f2d3f111eaadd9bcf8fceb3c9553753539c
SHA512 3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041
MD5 bc2edd0741d97ae237e9f00bf3244144
SHA1 7c1e5d324f5c7137a3c4ec85146659f026c11782
SHA512 00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 184B
SHA256 018ebec1b650600709da9fb8080994de4ccff92dbdf9f0abdd916b1f04efb0d1
MD5 33106cb1c7354af3a24fcb427d189d67
SHA1 dcb2dc3e2d327728172afdb9fc525f82233a1ec5
SHA512 6060fd029941cdce3c97dc872ae56d9d39495abefa76aee04db8db5d2d832aef80cc3c12125a710a52d054876e4bdbbf7012f2f519068f4ad768ac313351ab5f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a1ef0a3b52661f23ab414ba4f72d120cef3776a77f7340c940cab5dd276f28cc
MD5 b4dd934b35881c18242122e9cb5c9b4f
SHA1 bdc616010ae5cb0155c39d0a54fe52d7ba21ab8b
SHA512 576f6a4a7922e01aa5631b0b2f64b346192ea679379702abaf62129e57367074317cecccdeba05eb4569b4bd0a7f8e409ec87f323eeccfcf83e71a4bd472fe8a
SSDEEP 96:n+AkMOZ1EJa2wpvWMoiVmdeHwJroBOUWQyV+VDCziEwb:n+AkMqCJa2GWMXWoBOro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9ffeaea41483771cfe786649e75b7e0c660e4e269130e676f33f881d66ae890f
MD5 0a9284edab5f4943763502c6426bf5c1
SHA1 546f0ddeef2b2b98152e86e13a14a8952d66c498
SHA512 05a82a638f7b58bc343f41a2b75a19be73295c2d6291d1704a8ee7a599ff011209d8ff7109c5a7745e1f18de54c32a6a82d350f8911cb2ceafa31622dd0efff0
SSDEEP 96:n+AkMTZ1EJa8wpvWMoiVmdeqVIqwJroBOUWQyV+VD7AiEwb:n+AkMtCJa8GWM6SqWoBOrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0ecc4aecf764faba456ce980c170c66b96cb517fc38c8a520812c896d42b1511
MD5 30faa9ea9f54a8b0697a5a504a1b25d9
SHA1 782cd4d3a346d3daa457156286b15f72621018f8
SHA512 5a84176e0540e207f54cdd64800df3d30c3a5c3755fabdcbbed65cd2ca5ddd8023cf515a6efddd01426f2feadc77cfb26366bee22dd19a781b360be66bba2beb
SSDEEP 96:n+AkMOZ1EJa2wpvWMoiVmdeEIqwJroBOUWQyV+VDCAiEwb:n+AkMqCJa2GWMHqWoBOrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 44765183ae966a7f0ffad416ca67f15d4617ebf1c8ff288c74c64e9a5498ac66
MD5 15065f0b3ad88c3aa277992b30ed0a63
SHA1 79545ea93830d3e96ec083d75fac8875387a3705
SHA512 59eec49b94114684726b45a9a69a8cf1f867a33683cce17b26236a51a9729213b2c1509a8abc0e116902f8f760f0316b05befd831fccf6591611ed501589569d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupde2RU3V32gR2:A9iIxuERzA83h09RZxY5cIgR2
MD5 SHA1 SHA512 SSDEEP

Submit Download