14eba72f365e2cdd3a058bb334708f8f93d41bf609c90bec04ab7873ea263ba2

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14ab7d7f8570c94493e42db3579eab4c_JaffaCakes118.html
Size 57KB
Sample240627-ezwl2avdnk
SHA256 14eba72f365e2cdd3a058bb334708f8f93d41bf609c90bec04ab7873ea263ba2
MD5 14ab7d7f8570c94493e42db3579eab4c
SHA1 bcaa0a347fbdcd124faa0e6bb5279c2bbe4a2fb8
SHA512 3d17156b47190037765193d8ff8c5a3cd9fef64a9a1404798289364369db055debc432a1bd9708b42b7dfadca2eb2e9acde1931548bc0ee00bcb722038c7ac36
SSDEEP 1536:ijEQvK8OPHdyAOo2vgyHJv0owbd6zKD6CDK2RVrozDwpDK2RVy:ijnOPHdyQ2vgyHJutDK2RVrozDwpDK2m
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4204450073-1267028356-951339405-1000\{0F0F76F3-E705-448F-8B0A-2E5AAB394487}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
3804	msedge.exe
3804	msedge.exe
4596	identity_helper.exe
4596	identity_helper.exe
5316	msedge.exe
5316	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe
5232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 996	3804	msedge.exe	82
PID 3804 wrote to memory of 996	3804	msedge.exe	82
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 628	3804	msedge.exe	83
PID 3804 wrote to memory of 4976	3804	msedge.exe	84
PID 3804 wrote to memory of 4976	3804	msedge.exe	84
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85
PID 3804 wrote to memory of 4800	3804	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\14ab7d7f8570c94493e42db3579eab4c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a24f46f8,0x7ff9a24f4708,0x7ff9a24f4718
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4848573988794218202,999056148329421778,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2446e3cf383ce17d73efc1952ed3211e13cc1b235b737b3121da1094a8566113
MD5 d6269c597909a8e2a93bfec309a0c5c7
SHA1 5d40b3b40f3438e57476a9d976877a8eb9dae6cd
SHA512 5ab6c66403b7c87543d26a0c966ebcf924e804a57e27990897047a43cdba082ce17dd775cbdcbcbe9ed0e8e43235744434b828e71185b0e4cf614b3327295283
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_best.aliexpress.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 481dfc453f214f061687fd3d7bfcda77747b6bed6e72f0573335bdb9c945819c
MD5 5881469ed04e55552b5ae38d3df5d081
SHA1 f6f4ee6b9fab1e06c194d4c8b0265c99fdf96ebb
SHA512 1cf850e9b65da327fa4aa8cb5c7476518bbf4ccfc25b35d5348b13b40e719ae3b32e2459f62ead607b2b4c9237807a0f3968f181b50eb2d8328618393e795655
SSDEEP 96:J8UVQtvpBk07Z2cjUC8Sha6n+2otfWCpPvXanMRo86gDnx448vp1KzOBy0WqTo20:J8aQtvpBk07Z2cjUC8Sha6n+2otfWCpV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1e76f16458190ebec738aa155a24c52d23f9b436024c49738155c1392aef3913
MD5 2cff653982d91a061734481909d2d58b
SHA1 902b6f0f30b4c7e95ba7d7615e030a01e7b9dcf2
SHA512 e9a01c832fb479931248704f3f00ccaf16de997f19ea111807749e598743c0778f7fa92b9ce8bb4a84d60886fc4fadda8c04ef6dd6e64f2232cb48f2b258959f
SSDEEP 96:noklrI1BemwpvWMoiVmdeH1D4dUWQyV+VDCziEwb:nokOTemGWMXiro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 023e8ec1e9a106c28beb5fddac795efae409137b369029af3719325d96804b88
MD5 44cb8a2e0108ca5530dd287e504a2bdb
SHA1 836bca5ca84e8cf5027229764c13f0b365bef769
SHA512 91ac7b22daa62dce196106892ba36e4582f56d803c144cc2e09e923de707b59f5cba0d44e4ae8d411dd4f0c6d6326bf2028e65b6c7e5359d3e73b8467a08b27b
SSDEEP 96:noklCI1humwpvWMoiVmdeM8LfaVAGRZ21D4dUWQyV+VD7AiEwb:nokJPumGWM88LfaVAGRZ2irg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 240B
SHA256 1f89a5bb3237f5ca2be6e100db506b1a83d9610207d1246a13e9949ec4697192
MD5 eba201ba22b9c604152c4924f76167a2
SHA1 bcddc4b76410b1c27ae96d6731265c610c636d76
SHA512 765e9fa6b3c5a113de6edbfb624de7bddc396278ead282a8f13c2784599981f7418e4698c6758f4a3c561e19afa1b42146eeed7e88cd95354554d94c113c7e42
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57ae12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ae12.TMP
Size 48B
SHA256 c2de75a6170d6ef3e23c6878583471042650c35d931ebc311e27b2ac658e48cf
MD5 ae72d57bca1c1c6dae1e29023fefc3cb
SHA1 3fbf2bbde82a511e102e5116051a7632c8bea84c
SHA512 f39dd0fa9a0a69f3fa520fe34d68d6d66f58e6ac787718bc69cbab40a91a561de90f12e5644a59a55a9f7bf2e47c74ceb7166a3757b55740ad7bde9e91e92e75
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 7KB
SHA256 d704d16f61bfe246d1e4704afd2cd1afd09498c0d4c0b9b16d83f58919c3dd07
MD5 caedc397b03b116defe5f5c73f6cef68
SHA1 ca7836a0fa13cbc773f6d2091429cd7c5d9ba9a0
SHA512 e6826535f8013a8e4ee6dc4a5931c676333a79fdad9c20c762eda34f7dcbbaf79c154687995cf0dd6001bf8ef1d867504b7ddda2794225323f0a72de6aca2de5
SSDEEP 192:2UrUOU8NURU8UgUtUzUBU61UJUswU2lURUnuUiUkUcU8UmUuKU0UmUnUlUbUlkUc:2IPbN4b9egel1AsRimur9J3Fkdze2Q+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity~RFe578b38.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578b38.TMP
Size 7KB
SHA256 8f45807047034f667e78c79fcb386eb05ef8fc685d88bfc24037339ed89acb6f
MD5 9d0f56e780880214e72465935f261bba
SHA1 e8b47620bf963ff57b5607ae687420fd3a480c6f
SHA512 3470d74500938cd1065e5faf8d5d416155a1d0964e994e4687da46a174f33032128ae41dd6871d57060b282def50176a8521ff7d0afe2a245b14e9e97672d6a1
SSDEEP 192:2UrUOU8NUSUnUIUzUBU61UJUswU2lURUnuUiUkUcU8UmUuKU0UmUnUlUbUlkUmU8:2IPbNDaXgel1AsRimur9J3Fkdze2Q+kB
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 94f90b521fdf05196d5f2e4a5e568e649364c0a54ecdaa17c01dd762d063ebef
MD5 2788c95a188ec4ef1855f267fbc75dee
SHA1 31b70e342c01222cf33d98658a843dcf7c23b079
SHA512 1b2bcd1b12188fa23e4bd53b76d9a02fb840bc586bf5f53654363a021c48b5087471eedb69544bbc57bf74e2c74159c2c568384da99f942ce488242849070c67
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupzCe2RU/SRsVJbl8QPZrE:A9iIxuERzA83h09RZxYwRGVJx8QRrE
MD5 SHA1 SHA512 SSDEEP

Submit Download