93253db54cdd2e76fa0195f87e72df8c0398c107dc55014b9ce96f0b218b1f49

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c4316d3f6d8496b977f4a99d5be2057a_JaffaCakes118.html
Size 113KB
Sample240827-clvfpsxemb
SHA256 93253db54cdd2e76fa0195f87e72df8c0398c107dc55014b9ce96f0b218b1f49
MD5 c4316d3f6d8496b977f4a99d5be2057a
SHA1 cfa2f89da4c6c7e86254509e3b4af51e04976a91
SHA512 67b10df314b2248659215301c15145022465bfde6b46781d7d5a2262d38579427ffcae709b5f5e246369368cd7e6c56a695709d5d22adc5d7ba2ec9f38971740
SSDEEP 3072:wNBeCQNv0ffUcjvG8rMpCGxn269rCX7CeTsHkrhTBEJuR:wNBeCQNv0ftcfK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
764	msedge.exe
764	msedge.exe
4780	msedge.exe
4780	msedge.exe
5552	identity_helper.exe
5552	identity_helper.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 1004	4780	msedge.exe	84
PID 4780 wrote to memory of 1004	4780	msedge.exe	84
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 2040	4780	msedge.exe	85
PID 4780 wrote to memory of 764	4780	msedge.exe	86
PID 4780 wrote to memory of 764	4780	msedge.exe	86
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87
PID 4780 wrote to memory of 5080	4780	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c4316d3f6d8496b977f4a99d5be2057a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7fdc46f8,0x7ffe7fdc4708,0x7ffe7fdc4718
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7384 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,858275639706211959,1268362648551105004,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
MD5 SHA1 SHA512

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Size 29KB
SHA256 1a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617
MD5 e3f09df1bc175f411d1ec3dfb5afb17b
SHA1 3994ec3efe3c2447e7bbfdd97bb7e190dd1658f9
SHA512 16164d66d452d7d343b1902fe5b864ffdee42811ee90952cbfe9efa9847c58c0403f944c8e29db2bc2384ccd516b629cb8765e5e51de37da6efd75962cf82530
SSDEEP 384:OVysImDyPWquJMpx/SCYW0h8+Rl9yaZwuJ86YKSQCNL/J69nKg93jW1gngRe2Fr/:OnIm6IvW0trVJw1gngRLFr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 142KB
SHA256 70b7f058dd01599c07fc1141c6e197849e2dd18d82c12faed0dbcc151bc5acb0
MD5 2f03eb183c84a977c14e9e2b57b9e89f
SHA1 55a186e6ffbebc43c5c7addf0e320f9250310725
SHA512 449f0607cccb521a1734d21f177e3d444ccb8517a77d85f91a5f3bcd47e9872f99de2254f873850eb5d7eea88f3934b2161ec8ae7b6b57272ff7d7cfd1befdf9
SSDEEP 1536:oKJTzU3Ll4QTnNW69M/Fc869PQwU2llv9bQzA6/jWU28E2eIegZPEhm0Czt5eYU2:GJ4QsYP5RQzVj9KgcbE1qMfCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Size 71KB
SHA256 49987ef89c76396545bf199f5aaa680e770178c4c876cd524204c72d7da9a6dc
MD5 8da65dd6e50b9ef72cda55d9fd1a165c
SHA1 eeecd39c1791af50dd31f13a0e4690b6aabe436e
SHA512 5d8f02576775437d5103727bc32ed9313e52a556a70e7d6d485e0165764891d25c70e1bd023a88cb24f9c247689fd407578b5e5729330d81e4951e9188d6ecb7
SSDEEP 1536:pEKcAJoqtxlGhGohXsfMpodbXlYEqVsVNBH31k1BxJ9+Mcocai:dFptxLoh8EpIbXOjVs/F3oxJ9ZVcL
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 69696277e967dc5ab9fad7273599a85d5bab8557eb8b9fe661812b1ee965f155
MD5 163312276138a315d3fbe5e7683d598e
SHA1 174a7afe9f9c4ee0a1a97fb13a8a79107bb81586
SHA512 bab14be528ed183c9536f047079df021899e9d915f37a051c3ba3cacf15844301e2af73141fcbaf60e6e02e07a02223181976d36f407960a36f09756ae926f6f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 efc1dcf8be617e45051f44884de19ced6c2bf40a50f8cf0d792136c38ad520e2
MD5 2d4bdfe470de9b527445cce5027efcdb
SHA1 0006279fbd5f7e6aeb4bc470c4f5d469346625a2
SHA512 4cc7a09e02acd6da9fa8fdadf75c8c8c41f1431d08a2d82bcdc23bd89d9161832a4776ae23149f74579f0ea2107b8c41c5038830e67cda5f5304dc3d2fcfefc1
SSDEEP 96:AjEBUxZat7P8kPkGtGvGitGTG7GdzGwGsG9G95GfGQbb2Gnm:AjEBUTat7P8kPkgyPtMMKz1Bm25OX2P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 925265a90aa2bdab6b98f577cc6c9fc413cdc41cc17c416187529109aefb1603
MD5 4a1e8a01aa9eddb3c50301d1ddc3dba7
SHA1 15ce5a9b5caa6b0cd0094b8e898dd4cfcfcee4aa
SHA512 47a6efe6d7df58988b6b921e072fd39da9869e646e103d5fa4e1f23452cfba8206a07b52ecf3df33e8b7cc66b358b9a7febd3b9eb1cf2ecfaebb0a97cb1e8b62
SSDEEP 96:nQkRFJ1rAdwpvWMoiVmdeH/ddr/UWQyV+VDCziEwb:nQkRLh2GWMX1h/ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 97165f16b954df1e081ac6a9c47c484b94da6a0546296874971c0c2164fc20aa
MD5 f565b570548e91e5e07c63192fb28770
SHA1 a42f3bb87d7842aa882d49dd82e82d72dad83ed0
SHA512 d98b628cee74a7f22d65aeefbfe40e1637440acd3003010091fa91bb20a4b080d97d798258da480afdc97ce0888fa255840b87886e806eb6713394f6064d897c
SSDEEP 192:nQkRLhuGWMmeVNnP0tf6EPqRr8FjwBPJEO21h/rg:nQQh/Ws
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b2a948c5bfbf5296dfde3f7072fe139bf16e95cd1cbebb988bf8dc01d1d1c903
MD5 88079703703fd0dbcc8429195c2f42b3
SHA1 02bd4a7ccd08b8aef80812d5439956ae71ebeb1f
SHA512 53b37d766ad7a9a714c259fd42b4b9a6ce8df3c225110af3f4350296c2188b8b5612065aa2a5eca32e3b7ff32d79090742b842b254a6315115dc690ba3b5fcba
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRhe2RU923IFRw5Ytj9Zkl6:A9iIxuERzA83h09RZxYLZYGkLsCZV
MD5 SHA1 SHA512 SSDEEP

Submit Download