e0f120aa6fe635f801bdf2c67dbe62417181b3abbcdaa8976145b19c5ae519e0

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffe1edaca151d3fa7bc1a93b644cee8c_JaffaCakes118.html
Size 116KB
Sample240930-d659dazhrh
SHA256 e0f120aa6fe635f801bdf2c67dbe62417181b3abbcdaa8976145b19c5ae519e0
MD5 ffe1edaca151d3fa7bc1a93b644cee8c
SHA1 e3e52f4218df4e3754a5d0a4e6eecf19e063956c
SHA512 c2c63f2c5e657f5c4d2692364fb4f99e2cc7b82787c6375d66e773b896231ce5ce5462554cf5e49632ec5a46ed36465998029175c820b38d7ba551c4822452b3
SSDEEP 3072:oKjd/G+f8pTC316yDTknJBq0zH+7ECY99vyCRNXmLP2u2wqu:oKN7ECWvBR0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3732	msedge.exe
3732	msedge.exe
3504	identity_helper.exe
3504	identity_helper.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 3972	3732	msedge.exe	83
PID 3732 wrote to memory of 3972	3732	msedge.exe	83
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 4220	3732	msedge.exe	84
PID 3732 wrote to memory of 3616	3732	msedge.exe	85
PID 3732 wrote to memory of 3616	3732	msedge.exe	85
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86
PID 3732 wrote to memory of 4064	3732	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ffe1edaca151d3fa7bc1a93b644cee8c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd15f846f8,0x7ffd15f84708,0x7ffd15f84718
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11829989888307105594,10242009172781996943,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5552 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
MD5 ff63763eedb406987ced076e36ec9acf
SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
MD5 2783c40400a8912a79cfd383da731086
SHA1 001a131fe399c30973089e18358818090ca81789
SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
MD5 SHA1 SHA512

Submit Download

0f3ef709-0b5f-4e60-a72a-5bbc78a9c084.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0f3ef709-0b5f-4e60-a72a-5bbc78a9c084.tmp
Size 7KB
SHA256 7f7728cba0c88c098e1719a9ec04717ff89ce2ae7319b5d821d0b5d3935a5d5c
MD5 ae30faff43a1b38f75004f76055cfd0b
SHA1 71fc22c6d4d3e87137e68629540ac47e6889cf61
SHA512 60fe7c7edca98c21b779894cb709c49205c59dde790c0956b7afa5f60ca3420eeff3457b8d0e42fab6930671b9e14a7cbb2625cb65d20824e33bc33229daa490
SSDEEP 192:nUkzffr4GWMtNXZ6fQMAvaIYFbErcJ2V2OrV:nUWfJWrlWrtb
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027
Size 23KB
SHA256 60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf
MD5 2f24e0f5d2c2997a89fb4a8d943c141f
SHA1 99515bde1a5bf72105116ac902ccf3db1dd3df29
SHA512 0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d
SSDEEP 384:VSCKOXcXVC6fizIN66yBc1Ei49Zvi2fSZ886pETkDCm510VS7X+r27Z:aOX/jd6yJiOZa2aZZNAFmS7X+rEZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 0b60acfeaea5a4c7c8cd71e38dda7bcca1c1d24b434467431a6a80b1b67f0c9c
MD5 c28b434d3ec9e74eaf3abec766b1feab
SHA1 513aa98646eb44b7031b0682dec25ffc00b705fc
SHA512 072c116aaf716dfea4945431c2adb39d7ceab0154dd64e772906bd0e14018e791a4cfc1f0237f46872a690a6c0b89590f9eaa66a5eff721694b3d68409c62272
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 4bbf8ae2f99a40b95e02146aea7c074c5ed4a8e600ef646d934b5ed84e81f4c8
MD5 589d3fc3f84de3a5dc2e2ddb4120e998
SHA1 6793f20a2aed24524ebedf20da99445af021f76c
SHA512 d84d860fdf2e23068f0e2b9f8557baa820c5c27ef8c6ea33f11946a978bb07a2f7e83e808111200e4c0b4e5730d575f1ba87c0826def761c663b06b0e62682f0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 5e7cadf2a157299dfebc9c74f2dd667996bcf3fc73f72d2eb22717a9b116882b
MD5 bef7b340b2c1a3d59b606f7c1ebe20d0
SHA1 926eabe75c741ffc5395e1c41176c3330f48e369
SHA512 eabf6afd8c5de944f6420a16587524dcdd79410aeec1b3e82db929ae075ce432b4a988ffd71bb85f9baaef5e1b446f7a4d7ca0f828191f6b85febfff5b30a626
SSDEEP 96:JNH6rFOwxfDa7l50t6ejOhg5s3O6dG27GxGiEMGSkG+GOgGdQBYGZIGnbPG+G9vY:JNH6rFOwxfeh50t6ejO65MO6dJ0qMQP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 be5be9f990cdc25166ab5cf664228cbe7eab1d0d392f54f03fce5de6552951d8
MD5 61a64c478cf22323d7f068f0b6cde264
SHA1 bfb6ed85dd84c79160920beffe9400aab4279699
SHA512 73d0c98417c15f05947a2651a0c3f1d87aa74a2ba22146b1fc6148950469bf774613300736a970cc3879b6644121fa9c26fe033a208d38326563b039f1078c8c
SSDEEP 96:JNH6rFOwxfDa7l50qX06ejOhg5s3O6dG27GxGiEpGVGSkG+GOgGdQBeG1KGZIGnX:JNH6rFOwxfeh50qX06ejO65MO6dJ0qp4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 4f59a4e87531cb970175967c37380b5aab92a63e32bedac0823dd8fc06be6575
MD5 f1623042d6f597b9821005c55ba0853b
SHA1 a66a88d6855a5088e9fba24f6ebce5a995acdae6
SHA512 6f114a1ed4fd54625286859fe02d29009436c27909575eaee1e8ae59af60b4391f25c0a2af4f580a24db01f76d4a552cc37cddd8295edd9386b85bc1c0da8287
SSDEEP 192:nUkzfTO4GWMteBS+NXZ6jlbQMAvaBY4WISaYFAbs/ErcVmmJ2VdOrg:nUWT4WJBQJE3Arld
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e1e5b8b462adf5bcf5e9aec0e5a6ba5d9818fae32458369e851162f95f1db180
MD5 813c61b15f1b1102293b5415d69202a3
SHA1 cb5f1edeb85f6a92bc90f5fdd7be460025df3a61
SHA512 abacedb38e07b9b516b04afa7ce8fc55da6d1d7ca4bca21ac7ed476cbdc0748979bc1c27249eb352d9bad259c1592ba089a5ac55af6fc5f58cb27f0c4f1fcaf6
SSDEEP 96:nUkz2e1F004wpvWMoiVmdeHa00xOUWQyV+VDCziEwb:nUkzhfr4GWMXV2Oro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 094f8caa66b3a0f93104ff7b70aa6f1c341e95073944fd92b9ab0a0e5bc55d3f
MD5 98848f4274c5784adc1435db1e791f38
SHA1 2c00e985615a930deb57401db3a4258ceb40473c
SHA512 1d8cc2b774a5557833b972acec6a567471100a53e6e1a03d133f3a7fbfba25d186a9b453bcc9223fa576c3ebd572db0cc07c3da43c19b8c5115240391062e043
SSDEEP 192:nUkzffO4GWMteBS+NXZ6jlbQMAvaBY4WISaYFAbs/ErcVmmJ2V2Org:nUWf4WJBQJE3Arlm
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 4988f0f597ba2109789b0034241c0d346adc0d4a581afe5ba5f43f288e1e9be7
MD5 8f065ed9aa39f6789b55a914306e5831
SHA1 5317e95e34c988583cbe8498905b5271afcdc72f
SHA512 d515421f1e17e8927f87f7e9ffa331a45cf634294234b68e38b6b638424842a582032bbf89a083213c989d3ccf4877fadc4fae706a7fb0eae838a066a98d2e11
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c9e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c9e7.TMP
Size 873B
SHA256 6c8a36b64b634b4eed4bedbbec94ec62a5a6665b77ed47b98d71b792a7608456
MD5 f95c7f4c472f12ff22ae286b24ac4812
SHA1 1766bec8e612d39d2f74029250254f8d9c1372c6
SHA512 c5ec16f44307e9f43b34bca51bf956c967a6302302e17c78630d7a86061a81ce592732728dbacf272e0a281bf480da51df9fc67390fca06b6a85afa9d839b053
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 1d6d678a6e66699e4c03c893936bbf0f840697be4cad5d97e8b03a6345e04286
MD5 a72d7f49985e273a7f2321555d413771
SHA1 3e28d44f4e4e802e3bb3c037b373583c0a285f05
SHA512 4fd7c2fff1f731053e7020299b0de12af2ce7f1aeb6b2e883a43054f02fc8b08493ea7cea6ec18e44314e02a2bf498d736fd8b8c0c6932c460732f350b33d4b7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMie2RU19AwIcM/bo5ZxH:A9iIxuERzA83h09RZxYZRZqZxH
MD5 SHA1 SHA512 SSDEEP

Submit Download