b73e26470babe745e111f499e9ad421b3adfa903df86e69aaf9c99888a52224f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fbd9a9c528ad916f0f94748381b3ffc_JaffaCakes118.html
Size 118KB
Sample240503-ftc36shh88
SHA256 b73e26470babe745e111f499e9ad421b3adfa903df86e69aaf9c99888a52224f
MD5 0fbd9a9c528ad916f0f94748381b3ffc
SHA1 f18420adcfd20246915d05a474415ad9eb06df10
SHA512 7a4507ff2f5c2b68725262a026babe9c4d1f5648ce86d90b89aca072d0b38c61c2d575c81f911d6cf4de220fe6169a0b026d9e52940dcba7a835dc93741296c1
SSDEEP 1536:4EFwEzaTYDnBQ7qFujm2uBDfqqVj1AvTvo+d522Ek:h/sYG7qFujm2++01gTQ+d5225
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
11	sites.google.com
16	sites.google.com
17	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
1116	msedge.exe
1116	msedge.exe
3920	identity_helper.exe
3920	identity_helper.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1180	1116	msedge.exe	83
PID 1116 wrote to memory of 1180	1116	msedge.exe	83
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 860	1116	msedge.exe	84
PID 1116 wrote to memory of 2788	1116	msedge.exe	85
PID 1116 wrote to memory of 2788	1116	msedge.exe	85
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86
PID 1116 wrote to memory of 4660	1116	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0fbd9a9c528ad916f0f94748381b3ffc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff901ee46f8,0x7ff901ee4708,0x7ff901ee4718
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3316 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12107222608094456248,11528766178883089274,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32
MD5 9dc60aef38e7832217e7fa02d6f0d9f6
SHA1 4f8539dc7d5739b36fe976a932338f459d066db6
SHA512 18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700
MD5 7ac03b15b68af2d5cb5c8063057cc83e
SHA1 9b2d4db737f57322ff5c4bbddd765b3177f930ab
SHA512 a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732
MD5 SHA1 SHA512

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 aaca1e80c8b65a944c3b867ef8b5c24c8c62cbd8513cb2025a791d241baebd89
MD5 d572d7a8e32253cb863dc98b2f6f4d3e
SHA1 7455c0c532c7fbc977a04d8c96a5ad764ba0598c
SHA512 b0466685a578d5f9766c2e10ea801a78d879cb70915e358559b475a3743a661a2e15e51e4356d80447727c404271f2d1739f3e0122ffe14e59eda24528c25564
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 0597ff0b881d4078416f33da32f2e2288a2f9f0d34ea5e92e58c87e5c8685044
MD5 8dfe386e7b189128b0761dea9f9222bf
SHA1 46d31c9d7a37df27d0bbfdb8cad18989686d9477
SHA512 5f0f177632fc1c4698e619b3ebc959ece8c29e3f306b1dcde047daf7dfc00fb876163dc0cdc28ea885cf840d0ca122ef1db27d19788f514381d314bbbf386456
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 dd0e708785fb1c3c48a27d41a8032037638d2ed338a170a72b9ce3f93bbad33d
MD5 39ee986cc1849fd849d525f8dddc4de4
SHA1 0241680367cac504cea72a39c03718bd5a2a4ef5
SHA512 e59cb87e8a7523bf2174d476d5e464f9e861aa58ba7732a38a54c5e1ac3cc8f121e15c6bcd47416116ad19ab7f43194ec03f0dae5cd66185bb41daf554d2403c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 2d5ca10ddc219a8dfc3326c5d885898f0f30521666dd916ed0f4cac3df9f947e
MD5 5ffbd3048c59d38b2c57b6b9883cc70c
SHA1 df37faa2fe777860b1e212484e4ca026c765ba65
SHA512 5d28b2f8c01f85a710857866495d094ede9d8458ea662fb5260d1e265495f5dfe6c1c5c95bd1e594a6beae0b71f488950f5b83b26d65817d43dbc204df01db7b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 af9cd9d49c864872b489c2420b826d467b1a3d6e420131d51508c2f79de942e7
MD5 0448487949401e2f9919e152508d6e19
SHA1 d532c41e6e5d970027a33d60bb15ee943c72ef4a
SHA512 fe0ad062244353daa1002a3a8cb6a41ee367575e71a66f363e099251fde3e12e2425f1567628d380a4f48954af4ced994069154ef41e6e322bff18ecbe7e2a25
SSDEEP 96:ngkjzrq1/hj1wpvWMoiVmdeHVyMUWQyV+VDCziEwb:ngkW1bGWMXBro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 c745d430a05948f403512107d8b35a9420c3607e157f1360d2b8cf18566a79f2
MD5 975a5929cbcfa1a158962640931ca6df
SHA1 7c2eec9fcd8ea9e4eee1c5b01de32d8a1140ffcb
SHA512 c4b491c827d2d96ef711bb6c2763cbd81b57f8a31b466bbdab472a7f8cb664ab4d72a6b91334d0fcaa7e92b06f682273fb22b88df2431adfd42010b90bc2a213
SSDEEP 96:ngkjz+q1zqOZj1wpvWMoiVmdendjZGf94vVrPVeyZ4012VvMUWQyV+VD7AiEwb:ngkVdNjGWM3dtGf94vdPVeyZ4012+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 92d69b0576de71370e269c7aff7d2dbabe70af28988b0c174126a63672ac6505
MD5 c6963d1d1044e89b4d3b02ca63474e8d
SHA1 0a6348ab2b86bf92623845e47936401d5335ae76
SHA512 90163eeb3c4ca75bc9860506ed5e9215f6ac77aa8109d6c760e661fc6ae9603dc49718ad85b30738dcafddef24ceccf2bdbe80b26d46a55bced99806804d0412
SSDEEP 96:ngkjzCq1/qOZj1wpvWMoiVmdendjZGf94vVrPVeyZ4012VyMUWQyV+VDCAiEwb:ngkp1NjGWM3dtGf94vdPVeyZ4012BrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 88378fa977bad76ad7bdd85d0c940315a62a64ca3f0bf00603da9bec7f78ad28
MD5 f5fb406404699cfe87e8f53aa4b37ce1
SHA1 7434a30a850143072e845ad7ae4963c3f78cbd8d
SHA512 2fb905ff440fbac9f5d465a037d118814d24e89586ad866b1cfbbaa54eb076e91feba8c16ab11951c7ea3e8c66afc9bf2050efe4e819571ecbf117c651b64dc7
SSDEEP 96:ngkjzCq1/hj1wpvWMoiVmdeqjZGsvVrVyZ012VyMUWQyV+VDCAiEwb:ngkp1bGWMatGsvdVyZ012BrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 6609684040264e7b958adc7c36846b31373439a3cec74ac36db02e1a6bde6afa
MD5 b636e40186484697515b0b33d75cde50
SHA1 22c6890c5d6d8c9d32b497af3bdb267e53f5023c
SHA512 0c7104e612ac33d9601e188cc1a1bbed09987ea51cc4c10406d253878c3907ce081273d9d8413ac146088679dab94aa067074d6944932600f913a9bfe250ae4d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b536.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b536.TMP
Size 868B
SHA256 39c49a8bf47120560310df2d8bee869a7fbff41ea410d42862948907f8cdf9c0
MD5 643264fe20b3d24a097e1b13df261570
SHA1 e65d6dcbdf7f79a75491652859e37c0c7a6a7abd
SHA512 356286e6d333da3be92ce48ddc14509235a83c2a033d965787659a4a7ad14e6f157c9f238726ca7bd5513d42b89870d6553ec6408bf1377b262b577001e57ccf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dd513eb4b43e5ebdc61c5a27050285194c590323b96368018ff22dbfea035de2
MD5 836cd9ce9ccce0e77d03f69415a98fea
SHA1 bad8ff63966deb097dafd933c6d70b94c118da2a
SHA512 abe18de558c577acdd81af37ebd865834c8657bd18712d044979dc0e1abbdeba915a66dedf5eafc67da43bc3d17b7827149a25bc63f19ad1383e956d8311c1e4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfe2RUX8c7T8+OblfBhDaaJ:A9iIxuERzA83h09RZxYnNcf8/XDafEBJ
MD5 SHA1 SHA512 SSDEEP

Submit Download