58ee1024f063364a57651b852cbc4dacd5cf6301c987921f0692c6e5aaf69008

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
469f44ba067a0cd6768add783d276236_JaffaCakes118.html
Size 2KB
Sample240714-t1f1as1arb
SHA256 58ee1024f063364a57651b852cbc4dacd5cf6301c987921f0692c6e5aaf69008
MD5 469f44ba067a0cd6768add783d276236
SHA1 1f99502178a30ae9eab9266b19a4ed7dfc1fd914
SHA512 77ddf5bfc3e3dd02e800b82b2f73f53a904e035dbfe3ad6f6d7696e3c92e3c5805c6b8d062cac0d784095fbd2d45ac58e24cc84f4b4779cb6287da2df69cc134
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
632	msedge.exe
632	msedge.exe
1452	identity_helper.exe
1452	identity_helper.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3864	632	msedge.exe	83
PID 632 wrote to memory of 3864	632	msedge.exe	83
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1856	632	msedge.exe	84
PID 632 wrote to memory of 1768	632	msedge.exe	85
PID 632 wrote to memory of 1768	632	msedge.exe	85
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86
PID 632 wrote to memory of 4696	632	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\469f44ba067a0cd6768add783d276236_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e72246f8,0x7ff9e7224708,0x7ff9e7224718
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,985685585967621924,7891501197350744001,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
MD5 75c9f57baeefeecd6c184627de951c1e
SHA1 52e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA512 c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
MD5 10fa19df148444a77ceec60cabd2ce21
SHA1 685b599c497668166ede4945d8885d204fd8d70f
SHA512 3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 d1c321ff0543157b7fa2dd94257e8acb1328ebbb864a8dd13a2bba4ae1d497d9
MD5 d62dd1bedf1e8ebb95aa94f3640573f5
SHA1 72ae7aca689c14af5ed420c3d04118fceb98ffe0
SHA512 ea20f8888bb4e86edcd1fe4a068105c8fe99041eb489956db63516de1570b7792dd8ac2cad960b036a7d8ab635b84127c2eac48bace863321eb2fc18c38a8e77
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 51d5b958a5bb3535bbf49816aef0e2a969e59839890ef46234fe1147d98c1b5c
MD5 eb54cff217fffe2148cd538a2f60951b
SHA1 fb413dc4d4b661b7a6aae3a623bfed4b3b4fbbfe
SHA512 e37e6c3c4c9b14b9db06c2680012f9424060bca5473a189854ad90419a694623dca1aeb884a229bf41ab75ec542ad7ea64816bfa326b6437b57689daa4824cee
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1cfd1cd8fb0b8bcb006a01ea6faa9591ee46d99341ed93f5d56282aa8f300172
MD5 42318a5405b2be1dff0f796d9187ebc2
SHA1 761884ebaebc139815c3e49d9e6bd1f712fabee2
SHA512 a61690ff88b825bf7880afd8d27e29c94c4c5fe2311ede9477df3ef48c40e88cf62b80e1c4d9ea7fd7bce936c95585218059395330e08a4460b95bc0bc6a2434
SSDEEP 96:nEkDxm/vQYmqB1+O3wpvWMoiVmdeHjsFKZH5mUWQyV+VDCziEwb:nEkwki0O3GWMXQ05mro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4b812ebcf039615f8343092189a3459b38e14adf6f7c2c1e1ca5673a13d5069b
MD5 f29067588d6e0bec0781b9253e673d77
SHA1 4cc4e1e31345a315114bc998ab9bb14c842778ed
SHA512 a34373e6a9f036935d902266aa402ba060d3a446630b3c1a6a37e9cbd69cee57cae6868a690df3ad375b40a37d9adbd3bfe0e7f2a0e43389fa203a88972e9b4f
SSDEEP 96:nEkDxm/vnmqB1+O5wpvWMoiVmdeabs+2jsFKZH5mUWQyV+VD7AiEwb:nEkwWi0O5GWMqbs+2Q05mrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b38ff1cc57780c086869582ba46ae8f53b591a2d192c16c3bcfc79b1e18be9b9
MD5 7f3175a6fae600488ca1f02cbcc43df2
SHA1 c1a3de76ca4c6a26cb91ecefa8ec8b34bd614da5
SHA512 4609b48e464540652d497f2e47eedf5fba9f4dadcf8f3e0a80da5e8395cebf81b37f83f972cdd8ff91fd92359580d1d41d609420fba7b8f5af3562194804a90d
SSDEEP 96:nEkDxm/vnmqB1+O3wpvWMoiVmdeabs+2jsFKZH5mUWQyV+VDCAiEwb:nEkwWi0O3GWMqbs+2Q05mrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8ebdcaf3655480f17f7e484edabf772fbd269e97812540119355449f305fe8fa
MD5 f3546b1d24c2d30df25910cf2ba68d6b
SHA1 c96a716deefa91f3bdef52c0c163efeeb82fad79
SHA512 aff88f47cf1af15120288845cd6841efebac8755d2ec0e9b5c211d6cd2bfd42b766e161e821fed5efcff92b3fa321fec0933118727c209da819da1c1f1d2ca32
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupaSnET5l7/Le2RUw8H+HLg0:A9iIxuERzA83h09RZxYylNbHEh4HR
MD5 SHA1 SHA512 SSDEEP

Submit Download