2aca405b83f4588f84ac0abd140118236e0f30b40b25fdf8776f79231203c87b

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
791dd20d97f6dc19864647fb6680bf55_JaffaCakes118.html
Size 175KB
Sample240527-pemthace69
SHA256 2aca405b83f4588f84ac0abd140118236e0f30b40b25fdf8776f79231203c87b
MD5 791dd20d97f6dc19864647fb6680bf55
SHA1 4961f58148bf6451458b893efc039f7a1297d7ba
SHA512 9c7cf9866f7fd5e36103fa79a3f607bab9a98244d28dd786c87c960cf4fc78303bcf53a36cac0e9a6cd114ba7448b7d12fc604055ff89a0464085b1202c14af3
SSDEEP 1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3AGNkFfYfBCJisB+aeTH+WK/Lf1/hmnVSV:SOoT3A/F+BCJidm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
1420	identity_helper.exe
1420	identity_helper.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 3972	3220	msedge.exe	84
PID 3220 wrote to memory of 3972	3220	msedge.exe	84
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 4084	3220	msedge.exe	85
PID 3220 wrote to memory of 1224	3220	msedge.exe	86
PID 3220 wrote to memory of 1224	3220	msedge.exe	86
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87
PID 3220 wrote to memory of 2876	3220	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\791dd20d97f6dc19864647fb6680bf55_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff935e46f8,0x7fff935e4708,0x7fff935e4718
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,11205204623914920294,12770460997402530459,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 310722c71d7feea7ad39ac03901dc9a29bb7510db86cd23c70df481ee6ee5a42
MD5 88a97357cd0d817b081ad1502eb4c741
SHA1 2c1b98bf916f1137a96644e69285b7f2d72d171d
SHA512 1461b66b21dc7c95921d01bd27e87ce061637d41b5f673f66bf5ef642d7c07271c4d38273f19d5c198b3805aafc73fc2c7f10937335dca554b06e418c896a9d9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 831329d6e564b528ab9d6ccbdd77f37448d84d5815b4aafc6f6eb381f6045e01
MD5 a3ebe690bdb6b2ae887b28f6932c3523
SHA1 fafcfdcedc312109105623000bc7b39e5db69058
SHA512 058373eaf004c5ee62ede7870e194965a7bb1a986114e6461472aae3734c996d35eaab838d987a8cf02a937db4d53273ed56bdc123cf1e2c71e0f6e8a30a744a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 0da60c75d696f0b1e3dfa9d979c5720f184955b0c5223bd37811bb775c877029
MD5 3b3b10c8c3b438a1d469fd23426aadc9
SHA1 1f5c5178a5316670f54d1b7d16940539d4acba35
SHA512 b85458cecc496a4579ecc653caf6c429988800d1ced33f1f537716d3c4cf21224c0277103f89035957c82657cea289bb123036089b6d30ef886627d74f54c421
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2337fbf738c531d9235bab90cf38a806eaa3d2ee407193ed5081b65b3d6ac490
MD5 d1e1904fc0a8c9a0dcd7edd92be0ecd1
SHA1 90c0a10bb3f54250c3e114662ed7aa683cdb13ff
SHA512 9b37457882fd2ff7ab35290b35160faf6843ee5953badd3add5a699db39ef663b44d7f6eda3284dc0f02b7d643e9f15300584dea809181383341221011d1f647
SSDEEP 96:n4k5F1Kega9IQwpvWMoiVmdeHpCrWbrUWQyV+VD7ziEwb:n4kzkNaCQGWMXpBbrrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 63d9254aab8fb909a15bf62722d59fd99f2d15ee8e4eb302603e200d1d934aff
MD5 dfe0597fcb7de5a885ae3ab7b36d91fb
SHA1 26d35eee874580a0f56c16698d62e1c6d7b370e5
SHA512 17941488d92a4738d95a0a15d823de10caed3e7d080f17b8553af17667365f9897756e23a707748c77463290d8190e15c7b2cceb11db36b543d405f29c423d43
SSDEEP 192:n4kMkAaCQGWMldaY+toErKEd3HT2pBbrrg:n4NkARWiUr7yw
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a1d042abf60be87bc0b91cc1d2e717f54902e93c11c7d685a841da4fce34f02e
MD5 9f64520169bcce39bfe2a81bc6e9df8f
SHA1 205234af5821893d5a9c2947f9bb1aa4db883676
SHA512 51737d2c261fa61bef4b2c6740fddeef89554cec70092fb94c5d9c75c9afc816889a560476ea8e00514128bc0b8999d11ccf6d7550d0c54c56b2ca6ed5b0714d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwkkne2RUu/jf7Z13z2OMDV:A9iIxuERzA83h09RZxYwkkP/LzZ1aOMh
MD5 SHA1 SHA512 SSDEEP

Submit Download