0cc807e86bf32d925b8acfb41733c7a7fb454a7e9c8b755c89876c357c1dca6b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d35830de7bda9575f0d0f8fe4299ffd_JaffaCakes118.html
Size 465KB
Sample240510-egvxsahe21
SHA256 0cc807e86bf32d925b8acfb41733c7a7fb454a7e9c8b755c89876c357c1dca6b
MD5 2d35830de7bda9575f0d0f8fe4299ffd
SHA1 beac5d12f56ca28f5a931ee30c7a7e17a1179471
SHA512 d05512674fcb477e380eb06b2c51f2b1a18087104df3b4f1f20b9af2615284960c1274c7c85972d20e6109bc8af6d45c71e51854f0a3c7affa846c2816b15bc7
SSDEEP 3072:4Rc1tB2lzp7j0HhxjlFEg6geLJAmT00mlSIpzaXn51qjVC/epDm:4Rc1tMdOz8oVI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4608	msedge.exe
4608	msedge.exe
2556	identity_helper.exe
2556	identity_helper.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4888	4608	msedge.exe	82
PID 4608 wrote to memory of 4888	4608	msedge.exe	82
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 1612	4608	msedge.exe	83
PID 4608 wrote to memory of 4112	4608	msedge.exe	84
PID 4608 wrote to memory of 4112	4608	msedge.exe	84
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85
PID 4608 wrote to memory of 3984	4608	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d35830de7bda9575f0d0f8fe4299ffd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6ed46f8,0x7ffea6ed4708,0x7ffea6ed4718
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1880 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 44KB
SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
MD5 88477d32f888c2b8a3f3d98deb460b3d
SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
SSDEEP 768:zznaC0S3xL3KmGLYSKhxDefA2ihGqfz9fNfh0QqdgDnqQpvSjCQNs9f9wAcCGI:PnajS3x3K1JKPCwhLfZdh0Qq6dQNef9x
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 48e1bc30fb32f752834615aec726b76f63c7aa199fa228c42da0245df6af8354
MD5 4da60e12cbbd6516b57233b8ca04620b
SHA1 641f4b407753408a7f88c46fa99fdbc7d203f74f
SHA512 6f753415e8e7bd78e17ab9312e86644a504dbd0a2dd33bf2ee7ffdc036318cb01d8eaed5071e31932d1bbdb9d3ea3fc4b48e3fa9d6cd2b89ca0c468f6914904c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 32cdc12fcff47fefcbe5e099f1a4a0a88149d1b5a266d6f64facfa3617fbeb34
MD5 5bcc282be19ca638044fc4a86284c796
SHA1 647253c046041580509d6b0f92887f9e176bf7c6
SHA512 4476ade221a439572d53a1d40d377f3b434cf14f0c17f04ccd019555e368119ad7cbf0e614aee08324b43a7c87460db1b46abb54c369a6b9c53c6d6ddbb3f7f5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 4a9eb2c4e1c3c672b929a2a33a33eb1ca2147d61504870ca87f4c65287c5f204
MD5 8aa716ceab637c5deef2c24f1f9e24c8
SHA1 0c8bc295eb8fe64f1fd86234182a5d64215d4f19
SHA512 cee1c02cb39638a07dcea503cc97be8de445ed7cd545f1103c6c59fb6236ae2dc7b7803958344620f109d4e4247000dc34ff375937e5f62dd03761394e09b5e3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 67912403da01b961a187e6433a757d8d847bda37c07475bb2d175d9c081cf6cc
MD5 1bf9f5dad670fc8d2433f6bdbd5dcdae
SHA1 fed31e73e59b88491932ee122dabe125a780c5d1
SHA512 819b6c395788d10eb67a5de8397b81d08aa888e64b704bbe9db1445d60f1bf70de723250b925838443bc972f202ba16376a6e43c7c8d24f74130f92f3b5dff0a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 08eb0fbecb4d4cd2d696c3c4e9c507dc5ba7ac93f1409826320d0668d4d99b0b
MD5 80c646a6a153f461fcb5ba730a829bf3
SHA1 a6b61f5c8063e6913d511dec396bdb7a0aa51306
SHA512 ed41c60544499f19a089b9a14f4f7e7cefc1c55574ed86b7134a26f1ce4482e93409602e4109a44fc1f06e4ade7cf253a56fb0185e210f62d5eaf17fa17020a1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0f18528dc9891d4ee1c632240cb656522afd409525ed5574a25f2c98f61c2be5
MD5 8680e1116ebc33b5e3de134bd50f4bf0
SHA1 9d74f82d5f0fd0931176c6bd5b86fbac24f75731
SHA512 926c699512b7680935769bafbfde2c7dfaa73cb12d08522d4e20a3d333e4d5205f7817307a4553bbe7f41ee6a35f5fb8b8b51ba70faa62e5a089855382a0b746
SSDEEP 96:nXRkNxm/pQYmqnoa1/BwpvWMoiVmdeHBrzq8nga/UWQyV+VDCziEwb:nXRkOCeoahBGWMXU8nga/ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 452095a46ac4181380984b6811b272d2402561e8762abeb473754d9c4ae6ac8c
MD5 ad012cbcfae89c85dd7c4fa577215d39
SHA1 49045a0d32f7b87523d8f941f0beb6c658f7bd8d
SHA512 5d61e3d9e340cae8511a0ab21e338f0d98a6e410e8596c7acd2c227175110f70333f95cc2f79970696e41ed16ba547791a677aa8259935555604425aa306e58e
SSDEEP 192:nXRkOseoahBGWM0VeV+gKxbxliUzU0UDimp5ja42R8nga/rg:nB5hkWAM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 980880d21ea36ccd4a0d393e9d7c779ca6ec64ce70e4d658de4a0dc934048db0
MD5 70e696d5317b17cb89e6209f567a7203
SHA1 d37cd3928d8dfb56f5137ea8b8c8d9e769676b30
SHA512 6ea0723f3a81fa79f9ed42d2535ca5bb3e8fb64509af3d074f8b6e4882329832e9eda6bcfab685ed879d3773396be5fdd9efbbaed9f76e833b97a601c8b85775
SSDEEP 192:nXRkOweoahBGWMFKxbxlDia42U8nga/rV:nB5hkWjh
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 3e310ff985af07ffbbd43e832668611df3523e4b28d860afc613ae4a747070ef
MD5 767b1a71a9600503b3170f71a0e79763
SHA1 4bca803e3327681b8971f90618ce6ad9c2f0937d
SHA512 bc69c068cfba497581a36840750834d9d03cec3b8cce23bafb6dacbe7f084512159973289f5de4b1dce1492ac066f0141d5c11c28785503f854679bb337b6f17
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe583311.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583311.TMP
Size 203B
SHA256 09f30d64c8db29b1b6ff90bec75bbd94caf56e842b1647caf240615728023d25
MD5 11c8387f9c6355e2615f000be37d7b8f
SHA1 6230c021c96081241d603dca6778bee38784c944
SHA512 23db0b4634dc83c2828dcf1f67b93f84ce7803fcfe55fe95eece97dcdcaadac52778ec7362047c89a3d51f84534dced6bdaf7201c6da894c2ef99961c63ea611
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 675aec325e26b496d333429e3bf18d361153b8061820ff03b8f9ed993bcd9f2f
MD5 0af8b500dc2088e4900e965a47fbe500
SHA1 0bfb922ab314a8192d4fbc17caf7ea25e553532e
SHA512 10745a230b8a16611d93652cd31531560c9862cb0953755387aad65fd873c81e46fd2c4c12e1e4375f572c229cfea8272407abaf084f944016fd1eec5ef84191
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1HXie2RUtFyK/Mj2uaLW+O:A9iIxuERzA83h09RZxY1HMyEylLW/XDF
MD5 SHA1 SHA512 SSDEEP

Submit Download