2ac85ead2e4afcda74df7a46c284d1c92089a853ee5d0b8eccb7cb04d2a8833e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a53da5573ad66d1b5ecb128cf2d13322_JaffaCakes118.html
Size 240KB
Sample240613-ncf3hawemf
SHA256 2ac85ead2e4afcda74df7a46c284d1c92089a853ee5d0b8eccb7cb04d2a8833e
MD5 a53da5573ad66d1b5ecb128cf2d13322
SHA1 dbe6bd2d95227d897b64f56ef10f1d891e1fdba9
SHA512 9f86cc810bd22553714098fbd4c9d4b668e1fdcb55e8b9f07e74f3851b113567c79bd034a90c94ae4985a03fc8620a91ba1247289a0d5600b6e034806f83cbf4
SSDEEP 3072:uSY/CI+WhLJlMLxow0foqDD19PoZ+SMcEQjUEDXC2cDWTn:S3/2aiTDXCnI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
1360	msedge.exe
1360	msedge.exe
112	identity_helper.exe
112	identity_helper.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 4392	1360	msedge.exe	81
PID 1360 wrote to memory of 4392	1360	msedge.exe	81
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2828	1360	msedge.exe	83
PID 1360 wrote to memory of 2344	1360	msedge.exe	84
PID 1360 wrote to memory of 2344	1360	msedge.exe	84
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85
PID 1360 wrote to memory of 3656	1360	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a53da5573ad66d1b5ecb128cf2d13322_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97ed846f8,0x7ff97ed84708,0x7ff97ed84718
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16067816199367791627,17256567862278866137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e
Size 32KB
SHA256 0cf4e1d53901c6cf0d780455f2fceb9fd518bb6bad04f83ff2a6a38ab3c888aa
MD5 87b96a63d7d15946823f2627300f5973
SHA1 5bcb1bc895cd0db6a635039339fbb98d8bb56af9
SHA512 c1eb599322eb7c07c68fbdd7cfa9a62cbfccb3e8397909dbddd31cda1589e1ec77e9a384a5208c36f1b6d659b69d7c5ad39ea28b06ac9e4ab8857f4bd317798e
SSDEEP 768:bIZIhcEz9ova4GbxZIPukk0q/mfludekOAbAAi9ZU7Y:kIZovjGNiZnsdbAp60
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 a5ff362c6c56cab2c580024e8c821cc51abd3bdfd28973386359ed949763b4db
MD5 925821e2748cf1a4aca18001e4c942bb
SHA1 2fd5075dd280e79a49dfc86b5504cea192ca2b14
SHA512 9ba9090084360201dd2e9217e297e02da4017c8565b5495c757059d0277ffe5c50078ea5302d75e559247040d442f86c536ca8cef353ec8e68b0677d119f303f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 13a93aeb5c972e7c10e42d5851ec8c00fc2836d91096bf96db7c275602c78041
MD5 43c05593b92eafec9e43ad07fa9d1184
SHA1 d815a30ff011424bc84e318204b6bed6013be499
SHA512 556d64bb44def766e96904b9b799cb916a7994c5845b760e747a2ea4f2a4c59afaf5a72df0b1020cc981e64ac7def7c384c3e70f6b3c924b9f37179ed681fbe7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 3b3c2063af662f0a0fc470e6042b16d20cd033e7850f4e042aced4a41b06764b
MD5 b205923569ae30149d4922cc8480534d
SHA1 7cb4d7029692ee0de2eb4c5436e02abec9bd48dd
SHA512 cb312847fb5969d4e61724897de1eeba391546af4aefe5b2ce2b826b3c71174841a7a559be76980c5807e9ea2e0f222641588f223e6a14f5c5462a60e56cdde4
SSDEEP 96:/B6cp6rvYevEOGdTzGdT5GDGbGdH9G1oLGlWGaGHQG1uG8GLuTG4bf7GhE+i:/B6cp6rvYevEOS+yC+9OsoWzcQOu90u7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 09390f6c03aa49491ce17ae94506878245cda7bf1de488e4d72782a127c6c020
MD5 da10fe0079d4bc50f6a3fc36b5217ed4
SHA1 41c17eed886666267fe82ff46d504f9297f810ef
SHA512 d9bdd342bc217bf1d684798d472e524a3d77b6400592a1c1717d321ddeb04b419ba3de5c7385994e86861e0d770de75f12b19d9730dc6dc8ddbf9d1d93eaabc3
SSDEEP 96:/B6cp6rvYevEOGdTzGdTvGhEqGDGhWSMG+bSGDGdH9G1oqG1GGKi:/B6cp6rvYevEOS8LqyGWSMhSy+9OFOGe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8f8cb3d154f09db4d917197851aa9224879d4b19e36c506a39a7e75c49d31cd5
MD5 9f4f821411ce4f2ae289e7e6cd5d5b02
SHA1 fccd58b5374789e4f7e1b6a5ffaac7b29b54f210
SHA512 eda0e086ba269bd2ac7076fad83df7e8df76959de421b99c2f45880024b06fb0768aae21292a5d6fe65200497c54511d8539718506066bb6d1f4857f7751bf0f
SSDEEP 96:nwrkBoxm/DQYmqAy1FcwpvWMoiVmdeHIqQVT4EUWQyV+VDCziEwb:nwrkrIByDcGWMXdcT4Ero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 1f558b26734dd41e499661636bb4a12ec69e0c28c69eb30e0709c0b39166ef84
MD5 dfd31a49ebc4cdbeb0bd508a2cd0bf8b
SHA1 528cc7f054bc346dac104fe1d3e240644c1a3b2d
SHA512 34db3d8362e73a5b58289f1218e69a73d43351e654e853b4782a0ad14da40e0693e2bfda1a01c651304e6bc72d7b5aa33a058b58ebea05db9d50ab43a9645c49
SSDEEP 192:nwrkr6ByDPGWMfDENE8lbGfvKSVYKiSMN1kRfXdGpiErKyFH6KFmYO92dcT4ErV:nwr3yDOWaDNUCnDeKP6KttUjrKgFs5bZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f2abda21ca77eed13b453b6aa7ac59d306895f0e48fe9758a13063700c70528c
MD5 160d9011395cf6a30bfc7dfc431c39b3
SHA1 2e51f81f22470fcca6995cec419425b2c415b68d
SHA512 c3f4a4c54afe22dcdfb290e0d081cdcb69f6ea586eae1bf4c841ae7f62ac5f0f72eb86c366d24e0c493ada602360e0ace4fc51116967538d464e222936441c12
SSDEEP 192:nwrkr6ByDcGWM8E8Gf+VYKiSMN1kRfXdGErKyFH6KFmYO92dcT4ErV:nwr3yDpW+xGeKP6KttvrKgFs5bT40
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 01cab7a766694e7046360b7184d0aaecab2e012c8a91b9b26068a0d34d09bdb2
MD5 7fa7c85ef4e36f6aadc6c627ec6c7c30
SHA1 bda1af98545c833e008ae34ce64c30c45dfdc076
SHA512 b34670c3c1edaf43d714f72f899c93ab82e32de2a4b0c18b7af658e49e4c7cddc8ca899c72d41641b078dcc0a49c4966701b854777db67f606091b267001496e
SSDEEP 192:nwrkrCByDPGWMfDENE8lbGfvKSVYKiSMN1kRfXdGpiErKyVlhFH6KFmYO92dWT4x:nwrXyDOWaDNUCnDeKP6KttUjrKWvFs5k
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 bba0ed70393f868ca9c4878afaeb57a84ef6d2a70f754de906a8a798789968d0
MD5 fa760e8569a1cd9df03935c8e492aca1
SHA1 4aee8836402ea07f4a764515833404d666634074
SHA512 4658c3165b9e96b81afb7ee6f2c2c0793d4fc7d2174aa3c7654c04bece77a06c53e2f58c5b0a5167a1038de8aa8e2145180d65b8b924e025a1abf98d1a0af410
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 458dbef84371d387a475d4ad8b031fa0f47203fc707b92886ea4f4b741f42c7a
MD5 87096de9893609b04b7a2d18034b3a00
SHA1 dea03c8ed82b6d4c50030da9933192a255fd2c45
SHA512 d980a500895932c6fe7c26a7eac54f927ebfd0490adf5c65f69d166dddc739a7479712d8906ad096a3314a57d006aed5c3c2fe1ead3810c059f0af5eb190ebe0
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 ad4c8f9d0bc38d60720f090b6d69d23ef4c9ae68c35761a0a2e42fe4d97b3ad7
MD5 17bac911fb4e4b7d20effc727f8ceb96
SHA1 53f26f946b8b87cb0f69bec46148239076f715e0
SHA512 3796426d0170ac091193d06db4e213ac7f4fd031521bc5ba9b9642bb0c4ca7d0dd8a44348fa77758bc88db4ab46ca0969569013832473e87bc27d2fc58bd5245
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b8d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b8d0.TMP
Size 371B
SHA256 2c440252f055006d255749466bfce72f81159bd51b330c4557aadb2050274315
MD5 f83b681f992f7283c8511a9e83643b4d
SHA1 277676006d6e82aff851c739966e6731bfcccb6a
SHA512 3610df8a9f9341ac1e57640def6f2e3c384d0a7d94c236dceb3cbb812a367adad836119e40baaf3c8163fdb00f8782643fc7fa011945d048faae2c70cd9904b8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 24aaa405730a20c57a8cc5aeb11078c9985bf12fb5cde9e9acb2a6c43cc814b3
MD5 0b90ea8dc4bcdd4297c965bd22a85fc3
SHA1 dbd8ec2f67980f8629bbdceddbfcf21eebb38a0c
SHA512 dfbbae2c91307a45e0a739b28c56a26f18a1c8caeeb008771e93096e8e13ff8ebf0039203a9321e57f763935711c2df97066ece7e09da356c8653eeebb5ddef5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupM8p0Jle2RUm+pHdvRQ3z2m:A9iIxuERzA83h09RZxYMrJBjM9RQaOM6
MD5 SHA1 SHA512 SSDEEP

Submit Download