cb0377d1d56ac76f3d47210cde2ecb4b9781f6a1bec1ca04a75dfa666d48bae4

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffa9b9f04a984aabd9bea27174509b25_JaffaCakes118.html
Size 122KB
Sample240930-bnazeavalh
SHA256 cb0377d1d56ac76f3d47210cde2ecb4b9781f6a1bec1ca04a75dfa666d48bae4
MD5 ffa9b9f04a984aabd9bea27174509b25
SHA1 c2575a27d600eda6dec6b1bbe131509e547c3058
SHA512 aca2fa895a85b35e3724450f47a39490a771d024a54f9836a408fa629f27512705f061ce10ad72a2d80f5ee582358469ef9e9e9fceae52033ed45ada68fe5a8b
SSDEEP 3072:bNBeCQNv0ffUcjvG8rMUzGDg9rCX7CeTsx71odwh/HNt3V:bNBeCQNv0ftxTJN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe
2488	msedge.exe
2488	msedge.exe
3568	identity_helper.exe
3568	identity_helper.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 3024	2488	msedge.exe	83
PID 2488 wrote to memory of 3024	2488	msedge.exe	83
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 3196	2488	msedge.exe	84
PID 2488 wrote to memory of 1252	2488	msedge.exe	85
PID 2488 wrote to memory of 1252	2488	msedge.exe	85
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86
PID 2488 wrote to memory of 1564	2488	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ffa9b9f04a984aabd9bea27174509b25_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff83fde46f8,0x7ff83fde4708,0x7ff83fde4718
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,6008975212162796153,13246175441010268671,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 50KB
SHA256 f5521af95040c1c3c139265e68217d83cf12f834aca650099165f8b0d6fb078a
MD5 2240eb2676b3c0b4b48fb954e8ec8868
SHA1 f219a62ca457519cf7851e593c799c427717d60d
SHA512 8cebf290770f46f3162ae2780f6ef8acb9a31df5e9691a1a8ff5f3bc22a68ded0dc5596eaabfae994482c5467c3bc5ecb3c15d0d56e5d12e518136b760dc64ab
SSDEEP 1536:sgCt6jIw1kScJwb1lqb6w+z0F3d/YTss/cXRM0:sBgn7+21lisKt/FM0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Size 72KB
SHA256 1900351ebfe8f4267dee1e4b898575abc55f22d428a78a237b710fdb36d4ba49
MD5 1f88e4684bed1421273f597438ec92bf
SHA1 5b61932662bfc924a4fb5f0df518d239be1ec76e
SHA512 f326617dbc959a8686805c0dca6db04f15b3d744eeede214ed84dda0d7c889dd5176a177dbb2987a1c7d83524df0cd2aea597e6de71345ba89907cf361eac5d5
SSDEEP 1536:QD/5Sd3BVtwycmQaZt67yrsF6ezCF7jZYNz6hOat:QDYd3B/8aZt67B2qMh7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 b6daa372fb331863af744e4f0007e7700235928c9a3e76f0905fb134ea500221
MD5 84d213734bba5709bad9c4dc408a61da
SHA1 c879c666a752194d6ae5e626260d8b5367baa624
SHA512 33e6f06b74ba0d98fcfe3a79f84fbd7cc856443b0778e37ba878324e92ccf50c4d3d1c06675d4f85cba242e66cc7ebd36e863d93d4e4da3e4d8f6fede51c290d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 b81d0c2aa1e709eed987a1f42cf1885f6b69f0103df3003a3c1741dca5bf0414
MD5 25a3fb8b2a31bc478e35772ac9baa1da
SHA1 bb44797f884040e0980bf4135634e4a1da8eb2d3
SHA512 20f2ca97d6df6a8cc8e17afdd51dc148c276413298402ec4757709a5be428b266f8f43a9b17c5f35c148a3c6daa3ff79080aec74900dee29020ea59432f7f3c9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 b52716139a70f67db657c54b8d42b271b432c8ce998e0f5e988894cc3a380d39
MD5 3e763e45cd1583041853c310eb444e1b
SHA1 f0575a324a42108bfcf8001b2ea38465d747460d
SHA512 e8fbbd992ff4b601117de032c16bed0d6b7d8687cad17688620bcb631d6bf7870ae4627f1cbba08481c8e8d95419a5583b6da3238cffdd6ac7dd7b45f374f3d8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 7e8086e56a26f7222843d1075b1fa2382f554a6cf3f5de46910a89b371eae782
MD5 fd8c3eba7f95497f1f06686da22e3ea3
SHA1 4bbd4a81c38f542703403a9946d9cc21b0120a34
SHA512 3737e3f224232a38362a1113daa36b285ee33e8dfc1ca8df17e68701f54a362fb32e09816945b6eb26f8d42edfdc03f827e87019daf01352a32e8857ae5b91ac
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6d71e2a8741241b981a296f9890209341a8cbb1710a18ff54c350ba50a84c211
MD5 277bb1657a154b3a50af6b09edef3899
SHA1 6e306eaf16357fb88721d92af9eefa9459b0793b
SHA512 73f153791daaa8cf0028e178cdd2e6bc6b61231496884383422a2eed1fc642daee03025c2d411e752ab90d383322c2ad79ea4771319a521c892712a6b1587312
SSDEEP 96:nuk92m1oLOrwpvWMoiVmdeH4s5lUWQyV+VDCziEwb:nuk95yGGWMXlro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 38f48c22eeb37e2eb7bf1bfc1bf0a045b0e14006af5c216858761a6d980897f9
MD5 3dfa5010f3ff1f8061d5bcb94e746624
SHA1 52e12e6b4715c457dab017ccf02eec4ef9f8f62b
SHA512 bde5508f829898ad47a131f695e9013a36881725259f45f7bf7be55c595c8629ebc481ee84a7812c89ddd40ca8251e2ec157511297b24d3d9710894123b64aa3
SSDEEP 192:nuk9nyWGWMyeOe1NljifYfoEq9MdBbYhYCNY2lrg:nuEynWAV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4255329941da251cd0b52d3a6faf56b46e3e9f537731e5dda406373b9bd0d169
MD5 fa86a7cc3d337e59e1781bc3c6687a21
SHA1 8c19d23dac5729a7888a84f04f52e75a0eab4449
SHA512 e791864840141f637cd1b4c2f1d3918326944ae969bbe2e5bdecbcb7ccec61d1491605a03c58849cc1ca44d0d697d31f2f9984f0bc3ebc7b37f7462fb634bf35
SSDEEP 96:nuk9om1oLOrwpvWMoiVmdesRe/2ekyNPdji8oEndlYC24s5lUWQyV+VDCAiEwb:nuk9fyGGWMyeOe1Nlji8oEdlYC2lrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5be42acb473c98313df0184a49cb408c04343d760f7e0b2c446b2171e292b146
MD5 6d2c49b1cccdd36561ca1a9c23d837d1
SHA1 447a01cb66bb42de9d11134d31e7ab1dbde33dae
SHA512 9c364da98326f053b3f1fd23bdfceab22e8396812ea8ceafad99f0201af4a24540e0f1728c1ccef41ff2cbc876ba7733a72ecb4f9cc82d64da0486f9d45ad425
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupWe2RUGi6eIcM/bo5Zxw:A9iIxuERzA83h09RZxY453qZxw
MD5 SHA1 SHA512 SSDEEP

Submit Download