1b52ead3f0199fd263bb8966ce577b479de73e2cde8b1739998f250b5314bd46

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7d4da7c9904d0e2395c993327667d16b_JaffaCakes118.html
Size 53KB
Sample240528-rwb5faab98
SHA256 1b52ead3f0199fd263bb8966ce577b479de73e2cde8b1739998f250b5314bd46
MD5 7d4da7c9904d0e2395c993327667d16b
SHA1 9cd2d1d6492dcd2d5b72fc61bb308ef7d2c6f0d5
SHA512 8acfe4bbba5d1014e20adeb4efa9ccdfc5964e22192be9707838f2894e776d789b2a2e1b15e10a801fc8a7b0b4571b2a752d76c6f73e2097873edce854107253
SSDEEP 384:a4g/TiLF3JSdkkW26uHGwWQQT5uPF1NQRxWNlUvQPCCvWUBiZcXhaY0UI/DbhC6:FEeF5SdkkWusaQONlVnvWEDhDm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
4512	msedge.exe
4512	msedge.exe
5192	identity_helper.exe
5192	identity_helper.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4624	4512	msedge.exe	81
PID 4512 wrote to memory of 4624	4512	msedge.exe	81
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 4196	4512	msedge.exe	82
PID 4512 wrote to memory of 5952	4512	msedge.exe	83
PID 4512 wrote to memory of 5952	4512	msedge.exe	83
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84
PID 4512 wrote to memory of 6120	4512	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7d4da7c9904d0e2395c993327667d16b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ec946f8,0x7ffa1ec94708,0x7ffa1ec94718
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7644 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17820181538885639139,16198253563504270999,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 9b7e5cead8706f87be3441ad875de2abe680f807a75c755fc84054e532eddc06
MD5 fcde7ee72b4012bd877f2dba20677902
SHA1 90c45a9e4cd1e7d20b05048bea72fe4c7d37d029
SHA512 7b7d1dcd4d6e84a682cb758042ddbe0513ce50105fcca412b5fe829f0760261b6b9b8c9938cb08679dc49285c8a5538dfc05c3c6b835bb9fc88474d576b87c57
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 25ef9b7a36be9c7a0fb438b1842425507a4fd7262a82e6abe743ae2244af8e2b
MD5 a69ebe6fb2a9dffe3a283935c968a7c9
SHA1 800538bff2977701e22571f66c735ee9f1c29133
SHA512 2f93044ce9265f1ab5cbd2d2a6976f97c5537c1f5d457fa3089f7429ba7ff5efbf8822803d26d2bfabcb5f7a49ffedf7b312a6023d38ce6e778789f52ac4b735
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 24d35c2828b60db688134caaf3a1c226d80f17a015b1007ffbc4e0ee6689e13f
MD5 b6431df7f2a867cd04121bf415cc8b61
SHA1 9dc1ce939d7b97518061970e1c60f851e02da51a
SHA512 0a9ff03479b332e248c7cdf2050a5d34a6d4aea56c0e15df7dd173b33c9ef45eb3a8798f51b17c530e598ceffe973f66ebfc8764d0ebc8bcb1e3a16d66a8c0e2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b5c8be016ec937c86dcb5fc2e901cb3cb19cbfe72c2293f9381365ba5a11470d
MD5 a149ed5c5cc1f71eb39cda3a26e40b1a
SHA1 2ad83201f9715dee45c8384393b75567516553e5
SHA512 0d9b4c3fad542104f3ccf3e3adbde1a22348d438c549dfad04f8c37240a0795aef9ed6400b808d59ee5da19d8b2df058c77599611efe1099b9d3e9f5e678305f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 0d0c6cd1f507f8d4b7f5f65294c2c5143232abc824648cd287a4b4eb8425b0a0
MD5 a039d58fc36081f7a2feaa677b507e10
SHA1 0f647f621cc97e037e584e0eba2e950a226222bb
SHA512 4cb9c34bcf2055fed197d1747e5b58371a26cd325cd01ba74e04a7c4395f8cd8785d3b377cdbee300e55c1f635d030e611751467d59cb1db9a61b8ce77b55437
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 2fb368809d28f9997070a75296f1704dde300f007ac488543bd5e0cb3ea651d3
MD5 081fd1166ce44e3914890ea1622a4a21
SHA1 30ec778d9e3858e29535f282e13861c20e7d8f03
SHA512 91d42893889bb7440723d435f6b4ba55504e73e42f0c071c31b8c9cd7241d7f8ac58834fa51a4760a389c1663f3118346cf8d452df05f0285b2af69e8430ae92
SSDEEP 192:nUkU+YD9GWMZdHekh/it7xEfcYrOoVa6k22pcerg:nUZ+YcW0j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6a1111373a35ad188f7f70ab4b7feefbb568ba4b76bc5e1de89c1935e873547a
MD5 52bbff1ec68c2ddfe219720776b8e809
SHA1 d816839dfd275a1d0c2f15e0533b57bdb088efe3
SHA512 63c114c46bcd886451c14c89ea9c6748082ba7690de479e16e92786ea46461127a23dda4bfab623571c2c5f77964144fe162b2dc8ddafbf9229786c3323921c5
SSDEEP 96:nUk5R1IMD9wpvWMoiVmdeHpRQpp0JUWQyV+VDCziEwb:nUkj+MD9GWMXpEero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a7b24ac95d437164517356c3e8501158b85523a40698bed78f04aa3c712651c0
MD5 17391ffdbdae51845708c9296d7fa7bc
SHA1 d5cae1bece459c0e2c32f83d680599fd0c330e52
SHA512 eebe3f4c28a9de231d1563f474e5ea4a927413609d97ac973eb4e8a67756a5369bdc2e07641d2979a5a912159d20aa8c04c6e89652601eef4acf5daf9958baff
SSDEEP 96:nUkER1IMD9wpvWMoiVmdeJdekh/it7xEYzEr2pRQpp0JUWQyV+VDCAiEwb:nUkU+MD9GWMZdekh/it7xEYYr2pEerV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 2184654c6b513fe9d3f82235c9d3d4d019985ba30509087bcab4ad258e12d450
MD5 4149ea6786500b0b1722292748bec513
SHA1 f47b29802afdd42c4417fb9fefee8181e940d4ed
SHA512 42730ba83eba262cc9fa320d779f89263850cab6536cf58bb81f60e0006dc4de4463c5c0688e13674c8595c7455e7992bbd3c00a6fd7ad0a37360d605204ae1c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b229.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b229.TMP
Size 533B
SHA256 4771a938396a5f8eeee4c2c5c5e3532f1c6a6478abf6b1a1480f8c06cf51bda2
MD5 fa0ce76e0e4ac50edf12e1a54c58e352
SHA1 3ccb55d90284d9395f773ae68d68e61f2fecbc0a
SHA512 6b6e8425a3a3b60b1ef9eb8268515e9b13a04df45c8011c2aa956735c9da8050b503220e87d04a402b6c363c79cfc6e789e3d681816964b27e5671192b469baa
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6f49f08e9447dd6054e611969e1b9fed0a01ca99901673225d98f329c5a1babe
MD5 dc3c57224f26f6a77e10aa0cc525a9ad
SHA1 e658a9ac3364e8de93349103f5add50e11720ef5
SHA512 59d4ef59646dc5faaaf554304f320ff89c9e5edc2babd5e4097c6fa123010fadae100cd6ccd163ee21ce773c5e75bcb7a4a0d1b18125744cec674b84221be62b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupFukpe2RUPqzTL3z2OMDCRI:A9iIxuERzA83h09RZxYFuk9SgLaOMWRI
MD5 SHA1 SHA512 SSDEEP

Submit Download