a649e2575c8c436b67d5b159b16e8298e719a8e165986db4c285cdee41fad6c5

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20ad6adb03085dd87ad13a52ae0afb17_JaffaCakes118.html
Size 112KB
Sample240329-nedp6afe7s
SHA256 a649e2575c8c436b67d5b159b16e8298e719a8e165986db4c285cdee41fad6c5
MD5 20ad6adb03085dd87ad13a52ae0afb17
SHA1 78ce9e53fd4dbb4c65322ff97326cfa45303f9c8
SHA512 c486329cdb6af7834903d6748b2d8e51a54604d1ec5d03f70e36f0719e52102691aa9812ef0a79c1eff4130daf0c87036b2931262c745c39a30c5ce9610b1a03
SSDEEP 3072:FNBeCQNv0ffUcjvG8rMVCrjeF9rCX7CeTs2RtxTzIJE1:FNBeCQNv0ftyuRn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
3884	msedge.exe
3884	msedge.exe
3308	identity_helper.exe
3308	identity_helper.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 2680	3884	msedge.exe	86
PID 3884 wrote to memory of 2680	3884	msedge.exe	86
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 4000	3884	msedge.exe	87
PID 3884 wrote to memory of 1908	3884	msedge.exe	88
PID 3884 wrote to memory of 1908	3884	msedge.exe	88
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89
PID 3884 wrote to memory of 3548	3884	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\20ad6adb03085dd87ad13a52ae0afb17_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9533d46f8,0x7ff9533d4708,0x7ff9533d4718
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2596 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7384 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11185923599718969936,5870878271114637082,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5456 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
MD5 9f44d6f922f830d04d7463189045a5a3
SHA1 2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA512 7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
MD5 SHA1 SHA512

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 72KB
SHA256 85fbc7b58495400533a5111a153369368b9334154dfb576573e25dab48ef872c
MD5 2b5ee107e78b8e8d4a5ce2c165b934a7
SHA1 a686433f3a24df770ed674069bc0fd93a84fb1a0
SHA512 ef54096b726711b83e06c4c77efb9de4222ce86eb2da1c9f245178fa478755cb434ada7cc57a261888ed23fe6540dd4e088ac59a2fdc60d1b055f11888c8bf98
SSDEEP 1536:TV+yiZGm8IMZXhqwnD4ko7eKiiiXu2ltZESlDsv15t:APZzkXhq6D4N6e6OcsR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Size 50KB
SHA256 b19a06a42aa0eb841059cbfbdf609efa00b7ec7238291281c474d30fd3d96164
MD5 664d6a5f4f6372a9c2851d43866e3f90
SHA1 b997e9a2c289b042a3f32627ccf2126a92192fed
SHA512 2ff1ffcd4d362d0459dde0758814a11e4a5d666d90330987602ddf1f18ce73660e35f2b0f931982c5611376af0e705a19ca6bd794106c3a9b28d0debe7ce7f69
SSDEEP 1536:0b8KtDW1EKL+BmX9kUWIJK3LdPdbkvU96+oW9V:NKtoEVmNhWN5PdbkU96+d9V
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 369a1bc6b5fa5d780c38e68c85e290c25ed0fe41618889ce918c911e2f2a0e1c
MD5 7ff16e0ab6081a3da5fcb2215082acd7
SHA1 ac48687fa3695d15426745e61018b005f0ce78df
SHA512 0044b81a24c87e99efef7ec2ff028aa2f5128609a06a5aa92bd9d47235cea22645d1f16a75f7b5ab9542e0a27090c17203b9e3c4266a8454af251e058c85f9b4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 7347ce1a7ba56861974ab3622ca651de55133275026a1e7325dd6fdb4439a3c8
MD5 b3f6ffeb3f6d823488f75aff54a218ac
SHA1 ac48fb1ec012e6f0bcfb7df77f781a417821bf75
SHA512 b1695aca2d74cdb06f55794d682b6a2fab7a93429b2f7fb37f5f826297f3e14166b0c7d2b43b26966f6b53de1a33d5b3714f3cebd7b66e29990234e38e623ca1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 3625603a23a9281ce410f7d8d55393962503236b107de03130478f51e81b95fc
MD5 30d41c5927b28a136d4b76d4abcb1501
SHA1 8eac3f74a332b40b4eda75fffe6e317508f7fb89
SHA512 8fcfeba03c878d9e9e6bc85220dd0008ff8de9a91a7f8fa15b31fb846718e00f62d240612e71820c7a6e191761306e762b63220d98ba5b67f63fdb066f16791a
SSDEEP 192:ngkZH/lGWMVeUNb/wPG9SFVQlBGa2B3xse2NCrg:ng4H/4Wy7
MD5 SHA1 SHA512 SSDEEP

Submit Download

c2e9a2c0-5724-47ff-af81-338f76a6e006.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2e9a2c0-5724-47ff-af81-338f76a6e006.tmp
Size 6KB
SHA256 aed5809ce9c8177137f56cbe1300d69f1730c7bf1946fbbd3b33cc7e0b0cdbbb
MD5 8e04b91cd00346b9d4080887a4cc7ea2
SHA1 92523df9b357ad1acad56a2bb3635fb9f2bb66aa
SHA512 180766eb47da20c23eaca9551c51e0af6a2a58891b71a857965d1d65f9bae87f366af391a64264145fcbe4dbe9d937f80ad349b10f84b1cc5f03932bd85e36cc
SSDEEP 96:ngktU1NIh8lwpvWMoiVmdeH+G5qFjUWQyV+VD7ziEwb:ngkKHPlGWMXNCrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7a37ca896ef598cbfd757573b16c3f20d325771f6539d1c018da5aaaa68d58f2
MD5 5faf9220f3d3048b1a54a54032af5e1a
SHA1 f18235bfec9e1aeee8d47905ee8f9b17936a6e4b
SHA512 c0e022f1a203d33ffa04f71d90170adad379bf3dacb33facbe8ad51fe6f52139cfa4b18dbae30203d695ca9e6f907221b01285440730ca5dd237bc4f4127ca48
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKe2RUS7zebgGznIYWLSDg/:A9iIxuERzA83h09RZxYEV/DGzIDG8p
MD5 SHA1 SHA512 SSDEEP

Submit Download