028cdf6cdec4d846c14e2d5506026a5857661da7a68efa2ee9d2a72313c1e8bd

Analysis

max time kernel
147s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c39871bb8bc0f21f59e9c406cb367c9_JaffaCakes118.html
Size 66KB
Sample240610-2ykjpstgpg
SHA256 028cdf6cdec4d846c14e2d5506026a5857661da7a68efa2ee9d2a72313c1e8bd
MD5 9c39871bb8bc0f21f59e9c406cb367c9
SHA1 b905659edf8155dca68ce68180805200a95bd527
SHA512 5e90bac5047218477bd6e5b00cfde358936cbd5b76e0abef0580b7c29f519c64263d639b6b0c71276c80249db3203c4c79f91a09e09aecebccfa1219d3508000
SSDEEP 768:dWwgvQO8s4hKJ8HO3xxsWyYnEXP/8W6OACKgThaS6cgRrIys29kNZ:Ewgr8VkeO3xxhyYnEfSchaS6cgRrIyi
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
4060	msedge.exe
4060	msedge.exe
1664	identity_helper.exe
1664	identity_helper.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 1276	4060	msedge.exe	81
PID 4060 wrote to memory of 1276	4060	msedge.exe	81
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 2152	4060	msedge.exe	82
PID 4060 wrote to memory of 3736	4060	msedge.exe	83
PID 4060 wrote to memory of 3736	4060	msedge.exe	83
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84
PID 4060 wrote to memory of 652	4060	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9c39871bb8bc0f21f59e9c406cb367c9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd92c546f8,0x7ffd92c54708,0x7ffd92c54718
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11138380195886962060,10859172579058124635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 71KB
SHA256 726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b
MD5 da52e38c98b0f2047abeb07609608ab5
SHA1 da1210caff36df73e49a0c271ff7d573c2d20d02
SHA512 35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b
SSDEEP 1536:ntQRw6S6yzj9mN0hBcdYzdFONVzN7pPMJhJLY3T+2z9ANKokoV:ntQRw9BX9i0hBqSFuFp05LY3K25ANKo3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 61KB
SHA256 ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6
MD5 468446a7240461af44b59ebb2047c231
SHA1 47b7c525dc91bece99df0c414960b9490b986ba8
SHA512 ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8
SSDEEP 1536:8b3HAMT093crXTgJRNAZYBmuhSeIUQUYaoxMaagTEwL:G+WXTy8u0eiaoWJggwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 20KB
SHA256 fb5b531776f398b46eda13ed3ccddeece8fc54653f27b93fec45290a31cd840f
MD5 cdc9f19a52e87121bdff5faad76470dc
SHA1 61786f32243b3384fb8bd1f460070465d32ad556
SHA512 d80755833280d63ee7c894510ba25d1ef4ec55757798126bb0a2880b9d0f90489c0d5f5765d90673ee7d6670931be05d38c42929b938aab3d6f643e5cfa0fa3c
SSDEEP 384:yKvAZx6Ov7m6IqL8CYo2d20hOjnL+HSrK55EqBXrEVPGsl1vq:vvAZxF7m6HTgdLh2ayrQcVPGsK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 20KB
SHA256 6fbcee96ff03dda5c63564f0ffb9d19b21785809071ef8c06bc51f225daaeb6a
MD5 564be91cb7ef6cb7320d73790c21b568
SHA1 97c0c90fa1194cbbe5c17bff1dded992908df604
SHA512 fe6b743b8fbbefea37eebbfd28b8780dc02a7ef06fa41150b8ba3c74d74de615a0ea0c303f017b50af0b37470a962f7e4e7e9c84d6757fada831a2e841528483
SSDEEP 384:sJtcaLYpTfeOj8VXE1SH0kTXBKyyspDgVWLBvBbut7vpHfZqv:+i2KFjIISUMIMDgVWLB5but7vpRqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 20KB
SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
MD5 87e8230a9ca3f0c5ccfa56f70276e2f2
SHA1 eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA512 37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
SSDEEP 384:tC7niyi/By45+9iBV538WjAC8jNe8qUo4DdsmPMb7lV2bzOAZo1Csk/r:wrfi/BNY9iR80AC8jNdBsJb7A6Woe
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 18KB
SHA256 758015e3cb56989df5cfcf912d2c3861a62e623d386ef12d4bacf15891a4eb81
MD5 e4bedefe2836b39d626053935cf2f803
SHA1 105fc75ff4d76c2ae06e422f6304dc9b1552389d
SHA512 041aa8392fd5bc2922301312c4cd315b9af15bcb5502ac8467cf13e9d4e76e726f0822b50392d3fcdfcd0f37a119cc8afbe26e75130c36ddadb102d1595a0cb1
SSDEEP 384:k2OL0lPp/fbqzGNF3VQwlUlFdomdAaHoSbOrzYr:Hd32zI3VFlyFdDdAaHtAW
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 58KB
SHA256 515a231b701cffb320a2c46df0d9993219462ff20376bcca7006b3a1af431f11
MD5 279f5cec7d5bc8839a6c12ae78655bf1
SHA1 45ca2f8672816d9a30e7b5a33ee10bf4b3df3110
SHA512 83e43d0ae21eefd9c5271d780be401d8ed37035a1646ebd6fb0900a981d441e78c57a2b018d16dea28a80ef0cf5b31ebb7553bb765717aeb2abff2aed8c9043e
SSDEEP 1536:QvZpWTJKlBIT9hIJE9n6Z4ZPAld/Jy3QjnnHp3WOS:QvvrMT3IJkjZPAb/g3QjnnHpc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 40KB
SHA256 8aecf39b9f8bedce00d59b82ff7997cc3713fa06428a31602f0fe81f59a4b72b
MD5 fdb3c20664d837757e10d098d2b67192
SHA1 4e6bbb9f8eb2bac5b50be60b62ca2934e7581de8
SHA512 e3acd534d3f9913d81cca66ca98768e4d2aea230ea648b47284f930262a31e970b827d5c3e9ddd909643fb861b3128ceafdd4cab1211f1b13271a23cf50135ae
SSDEEP 768:feIhQcf4fkrTpidkiSOT+S2k9j3ulT+qZcOc8sSYn5DklqcLyWFeqasL:feIhPfkgFiiPk9j+EM5cdZn5DLcLj0q3
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 d5d8b66c35d90b26407e33d697407fa1e659858f5ed6da21ddde54681576dc85
MD5 d7ec6f989b71663957ebe60251bc5420
SHA1 b745faf4c15832633718f2312b3bc31c53a118f3
SHA512 725d2e0d3c7a3d3d14d0442e27fc748e1ecb7cbcdb7b2a23728419c7eee770041c03825f18d246b683019f979380dd16468ea0ea1af3b4dbf63f0dfced69d1d6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 cc90344e9eabe1636eea17683408ef241d4db231cbc6006c1f2520faa7019b95
MD5 3ee9067f6086342556bbb2449248fede
SHA1 d59efa5bf8d361edd7a35394014c955ae9aafa11
SHA512 72d624e0e564bdd1d57975dc88a1cfa303ae9fee8e622c54af7308ccc69f285fa3f5b9bd9d3ab83d9d257d57304a6de4793d95e156c723edc6735d3b4349e0d5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 4262542ea34eb5aa5694e31a61d3dc96f4cc80937d43dbdd139c83c36be7ee0f
MD5 28c103c7657bafc16ddd32ea29104b0e
SHA1 c4c4f932f4edfd672da84abac02a3970227627fd
SHA512 b6e88bccf0e072d1eaedec03481fb132df87738fddef4a77ae56ccaa2b67e9c556f592ae46001319d2d20f5ec2a2f335d13b31d6bffc7ebebdaac88bbd11a222
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 9ecc2109c60782e18d8bfd3aa2bc7489f029036dd4b39f6d3f3f8df54a8d15eb
MD5 076ff34b92fbcbef71402d4266bb52cd
SHA1 19dc5512a87b5ef332ecf9a7bca3caaffd123729
SHA512 e015918f532bae2e40fb94adfa9dd800b22210d63d3afd41212eb23b2c79970b2a1581d921d311ea80c3e63c17aa4d99e85a97591aa74120e2947e82ee43322b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8256d0dc217cd9899f56da742c991724b3df20fdc6e1567fdadde301b5c76a75
MD5 4d8a541da970cc40c0c692acf31a9539
SHA1 d09537de29668bca9daa235f3f06592dd2460315
SHA512 4a6127c6e6c3f726f68fb0383369bffcbc0940bbbe0c5fd6ddec25e8b5d025fc18aa94fffc2ac85a56fe043585038de1989a82ef54ff40d69072ff26313a736a
SSDEEP 96:ns8Ak58Dm1gzd9wpvWMoiVmdedl3OR1o42SL9LY2GzyYY9KwrMpRM1vxo7UWQyVg:nxAktSd9GWM/+v1VBEttSMpSsrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3cc47bdb22c60244855fcde1fff7a4c08750049a9482e174f22493c0c7f2b57c
MD5 4fa430cc8d707d173ad717a6d46beabe
SHA1 e1eb497b9b1459d09cf71f0bbf39b71aa3ac2ec5
SHA512 c7ce226c391715241c795e26f01a0bc9d3031c3de10bfe1380644f5329718fb79f1c137ab5e28997d13f910bd2622d63c18a2f4d86c13232b329eb0990ab966b
SSDEEP 96:ns8Ak58Dm1gzC9wpvWMoiVmded7/67IK7iv7zB7u47o07bbGz7tR79qf7Q9pRM1j:nxAktSC9GWM9n9ngNiebqU9pSsrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 26d5d76c4b808b171e2ffb118d8008e84f6c94aab836e653acf0146201de9bd4
MD5 63b7d98c55922f9292252cc070be1e6f
SHA1 f019c1a0515f9a1d1476857d0320052cb8363656
SHA512 64103ff967817ec835bdfedbf34c3df80b502514cdcb2867188f3d0d017506765cf885076742a2e4adc48ac746a280f4c582a2d3f594969965d2bbbf896a74d3
SSDEEP 192:nxAkySM9GWMhdhdnpKdAdMd0dqpJdMbpSsrg:nxAFS/WoPpMS+Gs3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 aa930da89bfe56d69a424ce396448014ea527b357a773fdaee4dc2157b127104
MD5 0b0f06e304e8fd9af32d3e11d5b49086
SHA1 0351a518503a2f6d8d509283c833ff8fb01c59a3
SHA512 73fa43d27238da27225fda453bfb7bd3ab3e81c5dc3d9bc5b0a418f3cb415c159c27a42e0915a32a4174777b0ef9620e1eb30bee34d275feccb55fa2f577eebc
SSDEEP 96:ns8AkH8Dm1g/z9wpvWMoiVmdedopUH0+YYL9dlm8GzoCCKq2pRQ1vxo7UWQyV+VI:nxAkbyz9GWMOaUTWz4S1l2pqsrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 7aeef3637fc5f1fab55c214934d818ebe0e4950ebd0b9ec4e60f57498dee9fa3
MD5 36085e36d6cc9560cec0633c3a6b3e56
SHA1 431a7141786fbb31410c3c88217d0956212dcf90
SHA512 4d07a99964af242067918b40aff5f2b412e646a0edf922a9fcb888bbb999a2474604971c471631fe450d82acce0a74eec6cac2eee9da47789e3bb7a5aa3f0f5f
SSDEEP 96:ns8Ak88Dm1g/D9wpvWMoiVmdeHpRQ1vxo7UWQyV+VDCziEwb:nxAkayD9GWMXpqsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 90e303b17e55a242586c682015cd798e3b1652f972fccf4b65b8c09fbed94add
MD5 eaa056583f419e74a55ac1f22d3409ef
SHA1 ad62007b622336d9f45c92ac52a09ef766087085
SHA512 020a4528d3b06f31fc7fb3c5a6df7c9c49d8a74723691ba6fcbd00611806b142535d219c628d6992c5766184b39c3d15d14140fbf8a4550375d094c1e913bae8
SSDEEP 96:ns8Akf8Dm1g/z9wpvWMoiVmdedopUH0+YYL9dlm8GzoCCKq2pRQ1vxo7UWQyV+VV:nxAkDyz9GWMOaUTWz4S1l2pqsrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 128b85790dd6ab035d5189cdb997e291ab3a8d1c9e3fe7e32d83aef416f796ba
MD5 ead92d26e2a46518b49aafbe381827d8
SHA1 fc7c8fb68ebc0d293bbbd82851973b4141bc8ab2
SHA512 3d3fae6e46514a82f51b37cfe4a6e33a6552d6e2dd90de6db8790a7fc26967fef8bf92297dbe9d56dfcad0df4277b3af1bd6b15eb67c8e5953d48f5cb1de13b4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 b532a222d4795454d5b47562f6d24d5d3e58e524d41e41c14367a6cd6a1f3168
MD5 231a9e99195df5d2dd2b93531c948d96
SHA1 a7c4b5ca5c771d3b8987c7295031c02a8cb84682
SHA512 129620aeb43f181a912f47a047ddab5acff2cd0408d3f6ad3ef61bc3c86a55ace60aeffcf4faadab6aae024b94a60f25dba2b276712ecf02301d6fd30142b082
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 6d85c3c31437a60238fb3fde24516708a4f7b0d8f16890bde01d4ddae08cd55f
MD5 4a426187ce3d3c01afc788f5c546f26f
SHA1 5af06af554cc9cb20ebecf1ef7810086e37aaf3a
SHA512 be28bd22e83ba31cc9cc801f786c28924994bbbee8fc5317f3caf98210320f988d6941591fd1304156f3687f32a57e8cca37146a6616d1f131dab8ae119920d3
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe586e17.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e17.TMP
Size 874B
SHA256 8d692db0c36f1af2b80769cc4dbfa42b4333546d21faaa235add56ecd6fcc007
MD5 76f8764754c9251d56e0989e15f7055f
SHA1 cd0e00f8f1474169a032cfe783a6553d6e44fdf7
SHA512 3e3b339f900f2bb502ebbcca3d3a7526d18754fb848fba85001b28316f18ede444766c7eb91d7dd3aec480901806a95b8d411a1e271dc40b9a812b25a140609b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7172497bb32c28d5ca2dcf6895bd7cafc6179bba221627bd7df66f22321c956e
MD5 78d1650265587655b2e2a3958a8b006d
SHA1 17bafb4232b02abdb99c633857c453075968c7a9
SHA512 124d3e5f106672e050e6219f082ecef4afb0f8b3bdddf14e6acd6b50e940b4c36a5d4081113f257af6ad903509249030828a5aed9c69e8a98e73ec413bc20539
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAze2RUgqT83z2OMDCRHqlY:A9iIxuERzA83h09RZxYAjQ8aOMWRHqlY
MD5 SHA1 SHA512 SSDEEP

Submit Download