98f4a9d8b672362a5f09438be0ac748b024a604b903c30186054ccb933a74557

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36a4da33d3eee19dea7ee721ea14da83_JaffaCakes118.html
Size

132KB
MD5

36a4da33d3eee19dea7ee721ea14da83
SHA1

62749cc4ff51668f96b3da739c9c673d4e9fcdce
SHA256

98f4a9d8b672362a5f09438be0ac748b024a604b903c30186054ccb933a74557
SHA512

fd1abe10a8508375a99a5b0b2a33aa5274576c576cf31a7884855dc38e43d149b77e26454e5eaed69eedee1b7d440af04523c294abc9aa18bc7b3e205fc47557
SSDEEP

3072:nxc4GLvSgPleUIc1NHKjn6I/HRhDpTiICv1SwB/Q4fcxBNXqZPLOrnDDbAr1bs:nxc4GLvSgPleUIc1Nqjn6I/HRhDpTiIn

Score

6^/10

motw phishing

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

7 sites.google.com
10 sites.google.com

flow	ioc
7	sites.google.com
10	sites.google.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 17 IoCs

phishing motw

Processes:

flow	ioc
50	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
70	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
67	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
53	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
76	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
77	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
75	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
52	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
68	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
49	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
48	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
51	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
71	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
79	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
66	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
78	https://df.onecloud.azure-test.net/Error/UE_404?shown=true
69	https://df.onecloud.azure-test.net/Error/UE_404?shown=true

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2992	msedge.exe
2992	msedge.exe
1500	msedge.exe
1500	msedge.exe
3084	identity_helper.exe
3084	identity_helper.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

msedge.exe

pid	process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1500 wrote to memory of 4776	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 4776	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 1220	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2992	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 2992	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe
PID 1500 wrote to memory of 3276	1500	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\36a4da33d3eee19dea7ee721ea14da83_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf58f46f8,0x7ffdf58f4708,0x7ffdf58f4718
2⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
2⤵
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
2⤵
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
2⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
2⤵
PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
2⤵
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
2⤵
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
2⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
2⤵
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 /prefetch:8
2⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
2⤵
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
2⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
2⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
2⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,17875844277529184094,12756213743212258247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
240B

MD5
2e0bd4d4ca5a31f646e3f255dd48436a

SHA1
95f010c7b7031a92aa4402cba1ea9018d7122e08

SHA256
1fb17f13e63a2bab966d8bb80b5707207d7125e7b81b997c4fd3e0b4b029662b

SHA512
95acb33da9aa563f3cc7ebfd4e098ec9d6a22483f1a5a87861b56fa7413803c2c9a53bac3a34cef0116bf4de7b55b8d27ac09e3947cdbe84309c00240d370a4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
04545aa797a200d7c4fb40e7de51dbde

SHA1
85ac8581e18914f148b1b9f76bb20a81e69154be

SHA256
a7e8391d59824fcf26c9a98ef3aa4d90aa1026ca9bc8d9e05c6a71640a415e34

SHA512
335b6c445742cb8ad1cb43ffd8eabe65093b689ff8b54f38424110dee300d8cc264361a1ee961d91b3d669b81f68890cd4371f057bfbefacfce8474375dcc1c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e274198b6f8f31323df73ae70bc888ae

SHA1
7b7f8030750094f0a2e5df957f190d735c9a21dc

SHA256
be7a2c1913964fa3946286c4fd2d322a746657219febd6d644e9eb2fb9985526

SHA512
179a4ff276f0516cf3a1f878a0ddbecc36946f3448229481e0198340d6df7746c19f7790ed77e21babad93e3ea404f04eb7e93a61ec284474d59146bdfb1c040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
4bd3de5b87240d39b755ed45eb9bcc35

SHA1
ae7440dbe3448624221e256b014fa606a2ec571c

SHA256
8100ee1f9dcc9aa3ad7b953f318464dc53a3c0bd941de5809738c73599ec1018

SHA512
7d1a6bd0f492f2bebc8799711ce83ce95c8d0aae4d0f4a36f3a7f7b0dde3335e18180424a9c03669f0dbb4071caa5b7665357373ec25621701df51e5b0eb6a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
199b5eca35f97fbf37628222f7c0a49e

SHA1
6e926ffc10d0a7ce78704b76cd9fecfc15e50c70

SHA256
0bea0ac77a5d26c4cd0e2043124a055c1983beadfeba81dc8c90a44156b80e33

SHA512
6d10746bbe6ca019507a564310be1473ba47d39ebcc4a646bb35b15a1c66f00d555ae3f8efeddfbf5266414fab356bf6be6b7c86083a437f06208887cbda78e3

Download Submit
\??\pipe\LOCAL\crashpad_1500_HRXSNMXNFKEJVDSB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit