74ad4ecc13bd86336737c176a935c5c646d9e87d3cd28da35db25108a9bf969e

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b1552b7e994432bc701e949d225f189d_JaffaCakes118.html
Size 62KB
Sample240820-3szbcatbpr
SHA256 74ad4ecc13bd86336737c176a935c5c646d9e87d3cd28da35db25108a9bf969e
MD5 b1552b7e994432bc701e949d225f189d
SHA1 623a1f04ac2ad0a92a76a8e4f10a0d67c770bf3b
SHA512 ec9e94e0aa3863959176b0f55a034fa03b87ad0066192f6baf9267145c23f84584841ee047caa7e21454dec64559fedfacac568d4cbecb5e87cb8ded5e55be59
SSDEEP 1536:viN5KWFbCiHFl/dIQuVFREKBTRRm7mQzeeZeemeeR9UmQzeeZeemeeRCjJUeGH2e:aWVb9RRms9VCjJUeGH2ubXP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
2484	msedge.exe
2484	msedge.exe
5268	identity_helper.exe
5268	identity_helper.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 4364	2484	msedge.exe	88
PID 2484 wrote to memory of 4364	2484	msedge.exe	88
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4344	2484	msedge.exe	89
PID 2484 wrote to memory of 4172	2484	msedge.exe	90
PID 2484 wrote to memory of 4172	2484	msedge.exe	90
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91
PID 2484 wrote to memory of 3540	2484	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b1552b7e994432bc701e949d225f189d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb91946f8,0x7ffeb9194708,0x7ffeb9194718
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17046440139025917566,1425874310091613638,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
MD5 e4f80e7950cbd3bb11257d2000cb885e
SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
MD5 SHA1 SHA512

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Size 135KB
SHA256 bea369fc5bdd5b9b473441583c46b9939232bf1f98c1cedf6bc2241c4f5068d4
MD5 cb98a2420cd89f7b7b25807f75543061
SHA1 b9bc2a7430debbe52bce03aa3c7916bedfd12e44
SHA512 49ccede4596d1e5640a9c8e8be333f9c18812d58f02b2b15adb54172df1387439e9dc5afc4ccd9d8f0f75f092318bed68d3cd577338e88ef4f9373de8a07c44e
SSDEEP 3072:v09yvZVdMDYywVB1DKD5q3OYHiB6wd77sX7GUhwUEV:c9y2kywx8sCBu2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 9838783cc689a010eea2dd43ad5aa1dfb5e0804dcc463ce123432f6779f55713
MD5 acffc4285056156493565ea026eba47c
SHA1 81bf3496ed72cffa76958f78c14eef11fa7e3b42
SHA512 e6e6303435c220241b2251f23be0fcc1476b592e5428962def8e975ad858b67eacccf50765b99cbadff2844392d8917f63c29740b7fd1d58e7916221f30b6435
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 d128e8d1fe3a596875db64e25f28d0f9f93c7874c986ec7d383d1cb5ebcd0d86
MD5 80ee3860c9226168773c1f392f645f68
SHA1 7a92305ae3f9debd87788e726b99602681b2585e
SHA512 a9dc60860c4dbf9557fc8a631cf3cb35955d164800bc0d56dd7ba3f84b2e6e504c0521b91e477b9522c32e5362f71e32fc1c409da97c4bdb5f2d8b5125b2ffc7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 b940de884ffefb285f5a8454d3b826185c9e9e0587cf1455458c3372fc19abf2
MD5 6787791aef1aceafec45fc5a6b03276b
SHA1 661cdd88b1c996d6df311362eb3e72b892a9425b
SHA512 08783b8ea5e47fba3d40e8f3732967fccb83eaed891344253e6b4a46d8db468dc305a0f4f2aba0e439ac2c5f61dd96b175a6deba0a59858176b2d71bcdc2cebd
SSDEEP 96:JUKogCZp6rxU504DC/a97PYkPdGyfG/GNCGOhGmGIG2bGNbVGlGDE+6:JUKogCZp6rxU504DC/a97PYkPdxfuyCp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 2a153e316b8fb5e387ab91716cbd16b5c0a9b6eda5c423b82f38e90652db3806
MD5 d8677e082a7a644c4f2d22e6f7dedf18
SHA1 860f31c484ba285c5d6bc44544280bb8d4d61d77
SHA512 b5469e5fde0800f96c333c06d67504264afe7c910f3d6389acae413a534f041896450edd64369b0daef829e0cc4f9a8c1589ded4ab043ac742946c4f153de3db
SSDEEP 96:JUKogCZp6rxU504DC/a97PYkPdGyfG/GNDGDECGZGOhGmGIG2bGNbf6:JUKogCZp6rxU504DC/a97PYkPdxfuyDN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e311267de2261f6906bfcb409d8f874138db8117cc78f7774a4e7f225e908f10
MD5 9a8ada94ece7feea3624bb3d9bb58721
SHA1 47952f7b89f65f475f64411c4fd9a312a4cf60d5
SHA512 7aedb82ebbe667e836b715b1ff6b429e678b584766087bfa75f86949f371b3f7d256561833faf418fbb17f386695f8e8309f532ae03db3c7c2baf37ee1e5fd68
SSDEEP 96:n4lkRoIk1PkTtwpvWMoiVmdeHTbZ/UWQyV+VD7ziEwb:n8kRIR6GWMX/9rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 41a9149488da440dc6eb243129640b90044f336e5418cb6fb357133ea614b25f
MD5 1d0c75c3ad2db832873e99f37b56488f
SHA1 e6e57ae684b16bbaec914c4125f081f8f695b663
SHA512 1cc99e348c0b42d0a1a1825ee91c2b3732d461377fa1ee946db237f86234eccc271158b1aa420e0485d4599367328465aa933f4a2b1ca14b35e4c946d98b62ec
SSDEEP 192:n8kR6RCGWM8rTZqvqfjwiNkMGdcs4r7V4dPBQ2/9rg:n8xRjWXtrmm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 17325d5ef30c37f8b3227db1ee201e1c09200ad446883ea8e2fdd6e0a4133f12
MD5 d1e320ab7a84e8919e3242557747bd3f
SHA1 185bd3595e3b45caaf5293a4513e6a471c224a7f
SHA512 780a3ac3c25e3b997b530f4794d55fba917539e96637f172eec6ba364aea9e1950b4acb5e09764edf1712c2d834f67a35f6a33f5e22142030d3de77a3e23eb8d
SSDEEP 192:n8kRmRCGWM8rTZqvqfjwiNkMGdcs4r7d1FQ2/9rg:n81RjWXtrdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d5803dc0bdb67b77460743fd0c7a9d1986a981add225126a580089eca8102322
MD5 0552aa8ad0df3fb4a0ef9b0de39abc68
SHA1 7911a93eab32e7105b2d57c6449012b32a306a71
SHA512 1976bcfa3f8684298bdab22e3968111f4b329fa78dcad34cb1b283a360eb98b45a46ec575456386f2f26d244867c5fb23d96bd23b88e8ec0b680c0e84a7ee64c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyze2RUWC/kjkru8z8ZJoJq:A9iIxuERzA83h09RZxYyjy6kPz8wJ2b
MD5 SHA1 SHA512 SSDEEP

Submit Download