a68b9ef96530f9cecf07f8a5d6664638329ec1fb46bb40c478d233ea8412aefe

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3a0184377c5904e2a8c7e00898e85d3_JaffaCakes118.html
Size 75KB
Sample240613-dl5gcascqa
SHA256 a68b9ef96530f9cecf07f8a5d6664638329ec1fb46bb40c478d233ea8412aefe
MD5 a3a0184377c5904e2a8c7e00898e85d3
SHA1 3e69a65684231772be4a168b7e6cd7a3f226c3d0
SHA512 417989ae761f3901683cd1d5ac64b8e4ef79cb2d7df2d9e6a50fbad9d3311df545f1b6df9e03f8f8ac96bf38c0d053731ec3454e36ab06a8d56dd85d2e83d2b6
SSDEEP 1536:aY8b8VkeO3D7B/9yNf3IC+OY6NO/9dcHdWj+kUzLzX9QRSaS6cgRrS3BB6:KeO3D7B/9yNf3IC+OY6NO/9dcHdWj+k7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
2820	msedge.exe
2820	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2756	2820	msedge.exe	83
PID 2820 wrote to memory of 2756	2820	msedge.exe	83
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4716	2820	msedge.exe	84
PID 2820 wrote to memory of 4536	2820	msedge.exe	85
PID 2820 wrote to memory of 4536	2820	msedge.exe	85
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86
PID 2820 wrote to memory of 4484	2820	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3a0184377c5904e2a8c7e00898e85d3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c9246f8,0x7fff8c924708,0x7fff8c924718
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16668781010476807331,11097023750859067377,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Size 71KB
SHA256 726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b
MD5 da52e38c98b0f2047abeb07609608ab5
SHA1 da1210caff36df73e49a0c271ff7d573c2d20d02
SHA512 35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b
SSDEEP 1536:ntQRw6S6yzj9mN0hBcdYzdFONVzN7pPMJhJLY3T+2z9ANKokoV:ntQRw9BX9i0hBqSFuFp05LY3K25ANKo3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 61KB
SHA256 ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6
MD5 468446a7240461af44b59ebb2047c231
SHA1 47b7c525dc91bece99df0c414960b9490b986ba8
SHA512 ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8
SSDEEP 1536:8b3HAMT093crXTgJRNAZYBmuhSeIUQUYaoxMaagTEwL:G+WXTy8u0eiaoWJggwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 20KB
SHA256 fb5b531776f398b46eda13ed3ccddeece8fc54653f27b93fec45290a31cd840f
MD5 cdc9f19a52e87121bdff5faad76470dc
SHA1 61786f32243b3384fb8bd1f460070465d32ad556
SHA512 d80755833280d63ee7c894510ba25d1ef4ec55757798126bb0a2880b9d0f90489c0d5f5765d90673ee7d6670931be05d38c42929b938aab3d6f643e5cfa0fa3c
SSDEEP 384:yKvAZx6Ov7m6IqL8CYo2d20hOjnL+HSrK55EqBXrEVPGsl1vq:vvAZxF7m6HTgdLh2ayrQcVPGsK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 70KB
SHA256 8cfac78e13af6c2f9b15b473c4ed4de518d3c42030f03b0fa7b6214492d19c3a
MD5 137fc0023de98a45ab29f7e1c4462816
SHA1 3db752dcd6b135f5f76156c84b27eaa3a2a72254
SHA512 66bd6f84071c5c6ea417cb885909ce6eb731f7379756c3a19103e64ab7083d5378404eb8a1dea5e5c7eb1e74aeac78f264202ca9ae4257c6fae08df2ea18a53a
SSDEEP 1536:NlknGhJVa8ffMn3kZdxlP/UUOuzD0EVx4C:DknyO8Ky9/5OWzL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 55KB
SHA256 cf65670b49826403201f36e9c825fbf4b175e8d502ee83c12c73089969efed5b
MD5 3edd3ec77c16893c538deadaeca7c5f4
SHA1 3e9f1e516f0041d71b36fc3b23b310f4e92bf703
SHA512 8ecd954563db0811087417312b1771681a4fed5f3efa600eb6d78bd793fec798c8b927c690359e696993cba0da0edbbadf568f30442e1986defef686be4f7b2f
SSDEEP 1536:feIhPfkg632mWSeMs27ZejvIUh5scgOJStdNXNC3Vp:WMPMz2QDs/0S5EfVXwlp
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 43KB
SHA256 aa920573cb213a875c378183424c3ee2c7bca0f028f1fe1afa9e9b0cbec3c479
MD5 66bc6bb65f6f81b7a22cb33c654a7340
SHA1 cb35c4c494dd014c64cd7f41b8a4230d796d8646
SHA512 6d4dacbc87cf73a6d4eaa6feada1f2716d8effca75f7f7b8e73a7959e3a03f18b0f4a21b52d9f840e7bb1a21c03bf788d0b4893204be5c06f2763c9ec589562e
SSDEEP 768:L8R0b2FkNerSLBGAf2VqMVupJLDMspxFbVjATG8KhWfGg8UbT1n3eA:AOi8JBbf6qMVCRo6dV2eqkUPheA
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 83d278c98bfa6e163f5ab3129c3d52ee364c5a5600ef39a5c8edbc59718b4e18
MD5 d56acd0a064f8d04ea7a3d9f12e66f9a
SHA1 4ccbd927191354c510558b607ea5dd90e725e74e
SHA512 82e93c286bede78b760ae35b71f560123249f951bb5905dec1e2e75bb49830a7f6f183e9b61376c453b18d22b526438fc6d7f9fece2ecffa2112109d877511b7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 ad7ac95b47f1083e534286a4a0dc6e4cd9807f5fd8a8ba59abae94c8e9cf64b4
MD5 70a1ffd1fff26cd3baa0e403dbf6e34f
SHA1 1a5d3cce93dc02866bbd6a942ab2b0c8dbfeaff3
SHA512 8400b2441b18de6542dd3080552d2bdcbf5cc60568ebe661306e1060ab5aae2eefc84404d1fbda9469361465cae6a9eefd78f7a82da13f84fbef1cc4baade444
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 096b63f757f111d4990d26f74e606ba302a0e7c72127f21ab2220ce5afd222fc
MD5 19817f936cde75d404a47734a46ed271
SHA1 2ddf1be8fecdb03e6a214bdc66a47238abe9b195
SHA512 17678f92d4af1826d108f998c11951df6b07b36fb67ef28afd5df306d7ec7ef7d8647d510b151f6fb53b320d09f5836659d7c77a8ee0b1f5970fd6871189b0a7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 37b99113269df353a7ea52cac6fd7dd50ae4f2d59b508445f3abbb1cb476a4f8
MD5 7b8599e65d72c8b64988ea7c385389da
SHA1 f621e1825186f735b433223ceed17c25ec6a7d5c
SHA512 0e60e0664786cbbfec17e6d4e3d8d6996c804805b622091293ad4831e7b9300d43be0fe754e6a52cdc9054a9676d5ea4b03bd65ef8c42209757457b9c25702a7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 22b193a71ccc0c8e4da27f51dd9e2db20d26cf8fffbc6a06fcc869422e072fa3
MD5 facc4f868a9a1254b7d57dc2f4772872
SHA1 c73ac8423fb51c0b6841e7e4a0af65bc767448c5
SHA512 f3bae0158bede3e902ae1de6f5b75a02457b57843a0589a4749f8c670c2355a9a25262f28e775d707ab3eb726a908a27bbbeaa8f35ce5bcd4f4532762ff63981
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 ab23476cccb4636a9bf1658e3fd4d940b578a9555ea4ca5a6c70c19a45d4b706
MD5 cea9d181642da60b2b3a9f7136b3bb60
SHA1 b9a86fbf4d525e93b31faba1fedadebb8e49f348
SHA512 8312f9d4fd2d79d0ca7e5d1646152dee75047ae0366ae69f4810370c3d2eadb6f11a3406fb8837e9b45856f32a9840394845ab02ec0abe185ec499b0e635ed51
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 4b4264ff6541280e7c70e16f3defe8bff1954ddb683a4986f90b2894d9da37a9
MD5 f7442b304cb45ae605f64302f22dbe1d
SHA1 fd2889e255b5083319de6672e79c8791e7fbb6f1
SHA512 4a056672c969fe56608c2e40a0300da9a7a5390081a33bd9a905b236763fa9b12c8d1280327a6b9f6307db1d1e3114392d6581ecc2948aa7852f80879698dbec
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ae6d54b80ff1be51c7297cfe5e3bc540c26e917ab560e3704fec57bc0d6ee248
MD5 fe441c1c09e976a3e3d4a21df1435462
SHA1 0611bafadb6bd6454ad566d4eaa32ba89af8ee3c
SHA512 06ec180b80a5997c5f6a0e7cb2c89286074cceac295c172b49a3fcb45a4821d4ddd513c6ebaf89ae74a51aba49074bb31eb8b95487485f34cf0dedcbd8803738
SSDEEP 96:nCkBoxm/DQYmq+19UeEcwpvWMoiVmdeHna4Tj7DUWQyV+VDCziEwb:nCkrIxHUebGWMXNnXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 53c76f0161f446c7ac9784bdb0e85a8e708a1e6b5638825d8e174f92e0454712
MD5 4500c3521f0992b1119b9d2df3260cd7
SHA1 815822d95e5d4ac0205a10209108a88882eb1dd5
SHA512 1b008d4fa8e659e5a54979feee0e0e352bbcb6c9d8603ccaee27ebe7b3ea0dc5215bbc6514ba05a4af832ca3c89f7f9eb1430ced102575ed6e6a57d10c42d611
SSDEEP 96:nCkBoxm/DMZLmq+1VUeEcwpvWMoiVmdeJ/CRKMnx4Tj7DUWQyV+VD7AiEwb:nCkrwZaxLUebGWM5/CRKMKnXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d3b1e813b5338af168d63d1dd90bc1033210908135d856d5acd0ee18ca031dad
MD5 18a3787b277a72c8e1d5555813638218
SHA1 c494b787d534bc2fc0821e330362056948e7fad8
SHA512 a866347f7dd95b8b0299ca659eaeb16dbcdbefd3038be955f937884b2272ffb5948a88f927a3d8f42c84bf53d6406283a2dfb79590d5e15805bb360a5c71df9e
SSDEEP 96:nCkBoxm/Dqmq+19UeEcwpvWMoiVmde80Njq2na4Tj7DUWQyV+VD7AiEwb:nCkr1xHUebGWMs0Njq2NnXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 2190ca3e5d6cd320c3be740c4f1e9a2c3838f807ed1d301b6f769107b4af3ef1
MD5 863a13e2933a71c0338ab7a78f3f6878
SHA1 fba0b94026d3dd5b89f83117e0457456304ba882
SHA512 ef7264de55dd8e65a97cfce8194146a5a8f9a8ee1d71a1192413e236471cef63e8306c819eff589e9630c49088b466bd06568f02f20bcc5c5b38bba5c2efe9dd
SSDEEP 96:nCkBoxm/DSmq+1VUeEcwpvWMoiVmdeVrVIP29na4Tj7DUWQyV+VD7AiEwb:nCkr9xLUebGWMFrVI+9NnXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d2fcfeb02131f69897251199c5e0afc5ae349f2f3b2f2d54083b4e165a85b129
MD5 5af596d29e29a4a914e3f9e25e7031ed
SHA1 6870af212d4c2b73c82bb09d991decb43fca8157
SHA512 0dc4e7ad2f6bfc63407f63bfb0f5ef98fcc14730b61d5b150fe064dd526efac7f3f7855b6afe16bed6304467d2a0525638b77e38ca84692a2be1339f672a19a4
SSDEEP 96:nCkBoxm/D0mq+1VUeEcwpvWMoiVmdeddopWdgdKbnx4Tj7DUWQyV+VD7AiEwb:nCkrTxLUebGWMNdopWdgdKbKnXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 dfb01c84ce28cf475232e517f82933b2fabe56198b4e4903f906020907088194
MD5 1380e978e027a21cf5ca7c2cb14f747c
SHA1 e256c311b49b6dfbe2ec4f5e72e58921cd960359
SHA512 165d563b1dc027b3d4459355963d42a7382415900383bd713cc090d6349f9df2f2ab74977a91a1ab970423dc1b100fc07e3ba6d50700a384d562b1f4019d4f45
SSDEEP 96:nCkBoxm/DWmq+1VUeEcwpvWMoiVmdelwblhqnx4Tj7DUWQyV+VD7AiEwb:nCkr5xLUebGWMVwblhqKnXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 a316eb0e7439263ad5bc259b3a29438b9cf44a02d945c8d552eec45bf000053c
MD5 cc1c771f30021a6cf65aad0de8d890a0
SHA1 f3375d798789d2a00b2af00cfd417522fb926c30
SHA512 27b63befcf080b93012a921495fd851f02dee76182f32b1a2627891831c508304c96ad72e15ef455c7dec8420fe2863cbb3bd86667b1c446e2477f84982c976b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 56bb6c188b21cbadbccc7692a64d183af994430b6e0871c3c90ac28b41adef13
MD5 6995f29c5074633162d397cb96027d4b
SHA1 07f784b307214788de1c8e07a568b778a5e54197
SHA512 c440480892dae9dd0d7f18a1020290b14e2cad1a781819c3e8d584ef2af45dacdc35012ae96772a8f9db874c72bcf7a03fe1c4102f1c24ec6fad992a7f53c894
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 63eebfcf2653a832a2fb32dfda84134ddaa4483f0a47496acc74035c51b66c3e
MD5 311c5dd39d349fe7f63098fe2a87c412
SHA1 2c4caab4197cabf7ade4e5f448b16a3d46079e57
SHA512 3a562afa637a7802099bc21c28bedcf4c06c2e25d9fe7ca7884f2d8060e2b1b094e76c6eea814c04ffee10b6bc08fbe548a8b1e41f4bc4fef578548b50133f2d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57f954.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f954.TMP
Size 371B
SHA256 e88d931f9db086c4d99251dd878163c4afe4a3c378d9f0d81dfe30023ad5c757
MD5 961e39664e19799de8a743331242e5b4
SHA1 0b7edd736998c77715c8700b38e922e0ad81019b
SHA512 cf2daa750c61e8bb7e87cbcf934a4d433126d51befcabd9b34f8f636f735c3a14f948216bf977d904a421d9674162eabe4b2855495ce8026c9cf66b13ca4885e
MD5 SHA1 SHA512

Submit Download

d112028a-7836-495a-8dbe-fba7949dad5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d112028a-7836-495a-8dbe-fba7949dad5d.tmp
Size 371B
SHA256 7cf53096bdafd3c058a8fbd5a312377c40e47d4ce146f20a3f9f23243bbcad21
MD5 23bedfe72f98c97c7b4fcd02c2b52e4f
SHA1 898950575efbf4a296f201cbc5f7f8c5a4c87947
SHA512 817d645b88368bafdf0ab36683a977f48c500e965b5ccb6bfad917b0780c0a55984b3941da4337bbbabc7d303ec76cc721a8fbda2470bf4ddc2b8a9557bc4e28
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 53bf25083356c2c72b18bdb03e1fb87255a771dff6031c3b630aedbba13a6041
MD5 49106c99e76ab2297992ebbe4f875c9f
SHA1 ecc88a68f405353e72c152747a6d7b981bfd46c1
SHA512 14091beccb5b1a32d66a54eb005924fc6249eeb058c34cd259aa3692adeffd3764d32b9e62faa6baaf0a679b5c17f93daaa2330742e695c9924043f8aa7312ff
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBGiSte2RUYUtA73z2OMDCX:A9iIxuERzA83h09RZxYBG3pOKaOMWRHR
MD5 SHA1 SHA512 SSDEEP

Submit Download