45bc1029a21740f14a1c95d6b8aaaa256b2afbe290c593e53afa53d2a311a6d9

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1282cb4dcb0c5c411bf1ee2ee92f68ba_JaffaCakes118.html
Size 119KB
Sample240504-nhtksafd22
SHA256 45bc1029a21740f14a1c95d6b8aaaa256b2afbe290c593e53afa53d2a311a6d9
MD5 1282cb4dcb0c5c411bf1ee2ee92f68ba
SHA1 30aea48240e59c7af2ab9fbb88154cbc14afed8a
SHA512 3ce1de725fffadf514dfe8c203c31db653b491ecacfe732d3688d7e3387c1c7cd090329e31951cebd15d101e435a84b3f3067b475641d766a3832aef551eb59b
SSDEEP 3072:EEa+DKnhVF5UoriYEkzkZNFRQY2cUKu7cqv9MH7Jo:EEa+DqfaNFL2cUKuV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
2168	msedge.exe
2168	msedge.exe
4280	identity_helper.exe
4280	identity_helper.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 4584	2168	msedge.exe	87
PID 2168 wrote to memory of 4584	2168	msedge.exe	87
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 2916	2168	msedge.exe	88
PID 2168 wrote to memory of 5088	2168	msedge.exe	89
PID 2168 wrote to memory of 5088	2168	msedge.exe	89
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90
PID 2168 wrote to memory of 1984	2168	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1282cb4dcb0c5c411bf1ee2ee92f68ba_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffee9846f8,0x7fffee984708,0x7fffee984718
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14694710745571945118,5610020765154326346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
MD5 62c02dda2bf22d702a9b3a1c547c5f6a
SHA1 8f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA512 a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
MD5 850f27f857369bf7fe83c613d2ec35cb
SHA1 7677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA512 7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
MD5 SHA1 SHA512

Submit Download

54253e20-81a1-464b-a63c-c36be5256e2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54253e20-81a1-464b-a63c-c36be5256e2e.tmp
Size 2KB
SHA256 ad5c23a3ba628c0a701515fb8bda6eddf76fe10b1bc6852a536f53a2cd54cdab
MD5 f4e954846659af41f179752d7e0ecea0
SHA1 2a87e7a8d00a9564714c0448d1eaaed7e378bc8a
SHA512 3cb0d288cdd05833f82a47e72d761ff86a1e648302e0364d352c15215a626b9b5166d053211691e6d7b427ddd9d7d97b3ad9f0a893b56368090b6d65a30aae53
MD5 SHA1 SHA512

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 44KB
SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
MD5 88477d32f888c2b8a3f3d98deb460b3d
SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
SSDEEP 768:zznaC0S3xL3KmGLYSKhxDefA2ihGqfz9fNfh0QqdgDnqQpvSjCQNs9f9wAcCGI:PnajS3x3K1JKPCwhLfZdh0Qq6dQNef9x
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 c879edbf4fde3ea61c198d6135e16c2e0365a252f62ed5306f7bd7881aee7799
MD5 83ae5a262ecf354dedf62165d5051b36
SHA1 b2eea812938d346b53170dcf2e86bcaf7a734992
SHA512 f56e3c8b3bf3767e818ded61fcb0fdd5c8e33887f83f2170a738dd22cf6b57244321923054ddc88530b5797eed7a196b49982d0ad977195229ee15932ddbea4c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 bb50e660d1221a249234d134c5e3e31bee4b8ff96fbfd4eba0fd84d1f968b38a
MD5 1cae5b8e2cf66189b159b0bd98027069
SHA1 b1a84fc5d4def42c8010c4b0f69e23b15a5e1af1
SHA512 ce75702a4b1d5cd0afec2c0976c2092894b58332e0336fceb96bd0dd590e7198211761de402869073eb23b5960bd867dd8a5502eef7864eaf89a4f0f18b19f81
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 709f1680c2265014548bd53fb2fd895beafaeeda1cee9033dad5e2378ae4bacb
MD5 ff2513cff94e0b509e93723d9e993331
SHA1 8ed8de4a527309da5a23a0d1931c4990cc12977a
SHA512 8f57aa5e36d73752858223aac4ad7eef22f6183cebc169318c3947a8e725b2619be130afbbf0d50c8f492ae6fb9bbb5adabb99ca6f1dfe3c2fbdb7f9fb529939
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b8e071941d9f5d85aa4a14b3449feede56e5f70228e369c39d8f10c4e80420f1
MD5 5e8b11f22787e34b0114e547bfe4fb94
SHA1 51eb606f48709247a31a485090af8deb7f059c34
SHA512 19092bfde37e288b2d98b087b2fa640b9ca4c2611f44f0cf8ccff749b2ced65952df5b556be69d7f8ad6d19a59bcfd2cc16c27a1400f0f5a5a5b6626c1897756
SSDEEP 96:n7kuj1x+fTwpvWMoiVmdeWgHm8RYp1aj2qzFUWQyV+VD7AiEwb:n7kAz+fTGWMGgHm8RYp1aj2grg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b084845570fef27922adfa0b60fbbb4eec8a2e1432478a83c3b0067887071923
MD5 13c7d65d27cdb960e4389ba2a8e000e8
SHA1 b8a9de065e5b9bb1f8de9c3174e8e38205c278c0
SHA512 043257eef6d5258046a12207e0899114ca07300e5e84cc4a6ed75863fefdab42db3446538dd197c764e81b81094982250fad295d4c184fa5502d29e165fcddf2
SSDEEP 96:n7kbj1x+fTwpvWMoiVmdeHqVFUWQyV+VDCziEwb:n7knz+fTGWMXuro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 43391c68040331bc2eb554d3a7f502e79d95f06378675107fc4783a858096b9f
MD5 1b600b08b3a28f88d17892014ab53ce7
SHA1 352fdbf075cef14e22faee65de0bd58003367f8c
SHA512 1ba193306133c70fb4b546e74a1ec0dea0ac5355eae746855796e6aea113eb9c528d94dc7a1e8b3ce97db0faf852c38d5ba186e1fff85e27c40a705e4e63ceec
SSDEEP 96:n7kuj1x+fTwpvWMoiVmdeWgHm8RYp1aj2qzFUWQyV+VD7AiEwb:n7kAv+fTGWMGgHm8RYp1aj2grg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f569129ffb6801521ebb457b4efa8444f90608e43b79de01a415d609eca29bea
MD5 faf3d2bd9c122d1ef472f42f59d437aa
SHA1 9cf8eded22ef02b68328e4ef39c603caa321ddb2
SHA512 183bbc6512e52a4d1718a08fecf86779aa4a56334db0cf09511cac521e152dd4145836acac7417451503331d2d528c647267c78bf4aa63fb22126967c8ded3c2
SSDEEP 96:n7kSj1x+fTwpvWMoiVmdeWwRY1aqqVFUWQyV+VDCAiEwb:n7kkz+fTGWMGwRY1aqurV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 872B
SHA256 98a9aa729a60ad028f809cec8ab65a582222b1fb99cd840016d21e78120c4f52
MD5 fd06200b4c3e1018d74861cf8c2b71bd
SHA1 d39752a7f149b5957651e7faa3e602e9c2e30835
SHA512 91a99e0f6d6a8c9145143824993e5eb0ffcce1eea5a5c787401e5d8f6f2f62b4206c2505e3818d7aa24c7c4926afe6142ca8c103ce304a57fa7c919d6e758175
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581587.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581587.TMP
Size 538B
SHA256 a41865d60ae8cddbc7512681b93dcaaf9e7e95e5aa87d456576a84839a107e16
MD5 3e4ccf367d983d287206013b5f002314
SHA1 ea488038dce9c3d98873e2f065d1e1bb325631cc
SHA512 ac05f80790e8458a814412c374db7c62dc1e27b3cf87e0806b20088bc1cf796a294a5af5dee47cfd5bae3d51be19426384682b968cdb33d7d34828d1afdaad2b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 60072a1e4aedfb00647ed842b2ed4be564484111d008017288287355d2515df4
MD5 1c79cbed3bca16c8616c393ad4a1114b
SHA1 846e940d7da4d165828cd44336c2cae5e4bcb85f
SHA512 d4861e45e8656e645219df1a0c549450effd3866321a5b0c3f00b68f96d9b71a33f8565f0d9189477626578efea18b067cc994a17ca9f30f5348c8c32daab5f0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuplg8we2RUWOEVCo+OblfBhR:A9iIxuERzA83h09RZxYlWoo/XDafEBKu
MD5 SHA1 SHA512 SSDEEP

Submit Download