4b49533c025ed66c2ea7aa8ed4d69cbde5a6192f2c6b6322a2634374228db919

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 13:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
845bb73fcf506d56266af99ded68f6de_JaffaCakes118.html
Size 508KB
Sample240530-q1krpsaf2w
SHA256 4b49533c025ed66c2ea7aa8ed4d69cbde5a6192f2c6b6322a2634374228db919
MD5 845bb73fcf506d56266af99ded68f6de
SHA1 90c65a05cc3c124e0d1d83bbefee96f0dc000072
SHA512 4a456eecc1e1c966e7a5fea86dec0e4a0b928a5929a720665f328db89d701df118242aedd13147eea0ddbe9886eec11c4bbe6756c4d753a37416b7617b25a7ea
SSDEEP 3072:wN+IpBxYUVc9zfs49PwVeL5AmPTmBBM2mqT1O:wN+IpBx94tLTD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
1072	msedge.exe
1072	msedge.exe
3336	identity_helper.exe
3336	identity_helper.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1824	1072	msedge.exe	82
PID 1072 wrote to memory of 1824	1072	msedge.exe	82
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 3224	1072	msedge.exe	83
PID 1072 wrote to memory of 2572	1072	msedge.exe	84
PID 1072 wrote to memory of 2572	1072	msedge.exe	84
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85
PID 1072 wrote to memory of 1700	1072	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\845bb73fcf506d56266af99ded68f6de_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d7846f8,0x7ff84d784708,0x7ff84d784718
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,14496215030741268348,16355214418060712142,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5216 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 55859ea6414e6694fbbc25ce1de512bd6a65fe346261eab175f73bc1905ee1ca
MD5 9aecde2c32a3d3cd62e1454a93c9a540
SHA1 e48f4e35900cd96e4ccf0d44f38ad0fc2223e709
SHA512 a2c21f9db287e72ac5f278c8ae3635095cd1ca7e80603501334842deccc1f0bf2d2bad5ecca1eb3e5202a8f5df011a66abcaea5a4733afda4a114553e5e7bf4b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 969B
SHA256 79729d90c55f576497aaf266d5ac3a68c0043db89bc33ec143afa59a0f8ff379
MD5 4732f4395bbd89eedad0419f163ac6a8
SHA1 346d47a22a10f4a139e5b41d9f0c9509b20e4c0f
SHA512 ba03e1ad444d09b1c497b85c0d3c8466dcc6f977066d4c1f57e84588cf0b45f132e0adf5475fa9e5ce2af17fd8f00fbb30de42f918231c5c93b7f111452ce621
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 583defb9623f1aefa1b2c8e78d90044503c9efb3ad8645e79144d379c7cdf5b1
MD5 5175fc569b719ba7f63ea72f98be118d
SHA1 85eef6f04160126b4a4aaaf243acb0ec75fce24f
SHA512 d3e572d0ba63685b0da3c8502ad0a5883c86f5888db16c1759932814b56f3b2e15d128e4bbbc161b8d3e1a8ee36d7e3cb11e51adab514c842fcd5fe9feaa9f29
SSDEEP 96:nmkOi13Jqv3wpvWMoiVmdeHplwtnacyUWQyV+VDCziEwb:nmkN/qvGWMXpeXyro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a57472a05f9974431142a1aca41d76256f14122c0ed5a8f5f0961d5038689cbb
MD5 e641c88927f0d1d88c68821a06a5ae9c
SHA1 f1143814f3bcb3abf460a0e2e9c590ba5cc5732b
SHA512 9d1c477f270f78d89bd5eb8ab5603b99b21acc021186d9e12e197f226847b0ad978636121848539af3312dea366327e4cb515a13e935d0b57edc8fe97866d3ea
SSDEEP 96:nmkFi13Jq33wpvWMoiVmdemfkSQ6NQz2plwtnacyUWQyV+VDCAiEwb:nmkY/qHGWM2fkL6NQz2peXyrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 272befb5a334a58e752162ecef5dc8bb84434c3fdf9df52c910dad94bbb20486
MD5 953fadd116c889a4639714c0aa498593
SHA1 8104a1e25c6929269baddd2ccca4d122f2ce90fd
SHA512 10407dfc42a49499d33d256b60509e1408ca40be16364de5ab757809e36e0ffaaf08ebb16225c6476c9ae4b2711bc73eb28db8381f6d1811224fbeaed4ae5bd6
SSDEEP 96:nmkdi13Jq33wpvWMoiVmdemfkSQ6NQz2plw7nacyUWQyV+VD7AiEwb:nmkw/qHGWM2fkL6NQz2pYXyrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 25fbfa5eebc05af10099d733c3c224433d060dd55967503bd234702a5d3861f1
MD5 c635b96919c754e2cfc9cf39a3a81bf4
SHA1 e74150ea174cead4cfb73780446aef23a8b628d9
SHA512 ab96831dc3ac194f8debd87c9bdc982f65fa4c6fab1406faf2dec86dc9f0b4de5217ad4c0532112f1bdfd278bdacacce28cc96a298da20cb3cf2bd43bf3699e2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmSe2RUt2Z03z2OMDCRHql3:A9iIxuERzA83h09RZxYbR0aOMWRHqlWK
MD5 SHA1 SHA512 SSDEEP

Submit Download