7f68020fb47e0d6b49b661dbfed2fb63ac369a827a5a9448c205734489e198a6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ec5b247fb38a9643a66d821e743a9d9_JaffaCakes118.html
Size 243KB
Sample241019-1d2rtazfna
SHA256 7f68020fb47e0d6b49b661dbfed2fb63ac369a827a5a9448c205734489e198a6
MD5 5ec5b247fb38a9643a66d821e743a9d9
SHA1 614a635c3f6a33d6961cfac5852c727f6481e010
SHA512 f29dc80265621431dd1a729b663d039cf8efba31853f80b060b70a5bf627857efef3223aa003ea0da7539bdba1f54e655b191f913716106e12a84f44cbe5fe3c
SSDEEP 6144:dvBo76DChyVFOsgi3ExeV63NrukyABilwrZ06B5m4oU9k6v4QuDd++WFq0op:dJo76DChyVFOsgi3ExeV63NrukyABilR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3688	msedge.exe
3688	msedge.exe
3840	identity_helper.exe
3840	identity_helper.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4456	3688	msedge.exe	84
PID 3688 wrote to memory of 4456	3688	msedge.exe	84
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 4040	3688	msedge.exe	85
PID 3688 wrote to memory of 3532	3688	msedge.exe	86
PID 3688 wrote to memory of 3532	3688	msedge.exe	86
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87
PID 3688 wrote to memory of 4928	3688	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ec5b247fb38a9643a66d821e743a9d9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff575746f8,0x7fff57574708,0x7fff57574718
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8324 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11483821242879825339,10847202870442755615,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036
Size 23KB
SHA256 60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf
MD5 2f24e0f5d2c2997a89fb4a8d943c141f
SHA1 99515bde1a5bf72105116ac902ccf3db1dd3df29
SHA512 0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d
SSDEEP 384:VSCKOXcXVC6fizIN66yBc1Ei49Zvi2fSZ886pETkDCm510VS7X+r27Z:aOX/jd6yJiOZa2aZZNAFmS7X+rEZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 9d39414ab220c8bc3d4a8bd65512d83e428f83b94d9370689f5e2849c36c4cec
MD5 6c42491d290a5b5702fa783ef438ebab
SHA1 6df91da1c9cab7d59b4b6da18f236b15b4a47c33
SHA512 6c91fdb9b0f3ac69699d0ed4ee7373fdd6324437a012384c31142d9bf2bebcc0290c6b3ac4af5d945edb814c5e430f2abdd8d52cd2bc981b69f871b87609c89f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 2b0cbeea4885538f635208454479e8fa010d6e434b9ad601576e85539a648f42
MD5 2d89a74940027a40e2ec610354fc435c
SHA1 2defd15cf4421ec2086aa4dc36f39b6ba69881aa
SHA512 472f3da88a087595c0f898b79231aed6990c769fb7b959a95e3fc5d0a18ac4b53660061943ccba9fb5a295b1058e58e7bb1b955ce7b59ca8620ffb314f82d35e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 e5416fb8bd4ca205d184c105dd5fe662a56674e8479211924f1c91f3acef34d7
MD5 5325e8e6f1f1d87f0cc971a13e8382bc
SHA1 f8699fd39bef0678b6ee97fe0c53f2faa711222c
SHA512 85bc4a5172b87c473062335f089f76fdb5723477d411c379f63c2aab4389f3a3fe78359c1f51c3d22f2a92121d698011f36928f6dee7b267b2d7598a1b2af6dc
SSDEEP 96:JWntDL6rFibU5543CrGjGyGfGBG1EYGNG8G2LGAbGfbGdMKOC9GAZGdY0GTG0bfm:JWntf6rFibU5543Cr23coLY21nn8bqMF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 61c9a8bdbf508f858eeba106fe348601672d255497b4f907419b73a423264195
MD5 fb096cfe704b39032e3a8eb184503a8e
SHA1 e01dc2709a3be5ec55a69a1a0b5950e7886eba9a
SHA512 afeb5ec836bac5556d5fb86d81ac12a49aeb06591204b57726f49627d669d07950290ddfbcd6ad1cba9975c10345c04d6008791b0c45546235497fb65af5ea80
SSDEEP 192:n0kMOajaGWMV3Ke0NDyV4c+EOnIfsMYoQOMOJ7ErSEhezwi2V4rV:n0pOajbWGc7rz3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 af1de6b29b20ed26e9f360d4dbc06772e02e51b5ca823ea93bb9f8af746c643d
MD5 638efaf28f9d88cffdda66837f57c977
SHA1 1c402370602eb8efd36fc4d6b3536ba4064315ac
SHA512 25870afda7415eed6f345d7a3c8eddf87604c75dbb014da6006530a02d6c1a931a83953ad0364f59cbd15174cd68e7b935e9e403d924900d9212e16a8c722b34
SSDEEP 192:n0kvOajaGWMV3Ke0NDyV4c+EOnIfsMYoQOMOJ7ErSEheV2zwi2H4rg:n0yOajbWGc7rzU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a1e7d71d1688adf61058051f9551bd6cea0d47cbdb1f7a3b91ff719de9bb59b4
MD5 75dbef881274f0117266aec25b97a5a1
SHA1 372fa0d280f5f4ae5108bbea60474e530e9bd174
SHA512 ed6087f017f228534ca96334f751b3d558715987a055a0d38d878c1cfab317d2486f8875c26dc4621d2472d0630307e2aaa708200969717a8212c4fe626c6645
SSDEEP 96:n0kiZ1sd1SnwpvWMoiVmdeHdwdG4UWQyV+VDCziEwb:n0kWO3aGWMXV4ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 eec8896a29c1c20bedd32ac1f14a46794e4cdd1c7d4a65fd04db1cb6c4afd446
MD5 b4680a92772a9abd7d0b9029f47d6ad6
SHA1 c7600bc998c2cee811df453d8cb5bb1bf0c6f3a4
SHA512 23d9a6f209fadcec908013e36399a54cd9436f7478e232fdc3ac39c9dd2185884fe012d242f9c605e8df48512842a607f2e603698880162a28943a8a2f4cab4a
SSDEEP 192:n0kMO3aGWMV3e0NDZ4c+EOnIfsMYoQMErSwi2V4rV:n0pO3bWecbrFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 53d6c6a62f69d20c7490bd8cece834442111d389c1941e3dcde6dc9609d180e7
MD5 f2494fa5874a89664a103a34b90e11d1
SHA1 59c5e906114bfce5a0a5b2efcd2bee22ebd19f59
SHA512 ceddfa393655dfe5ad639b917cb7885e23be9913486983d079963e1ba98ac4cae4ff46dc75e39d7617a6ce1d27e700e9920ab10558e6fff8d9089934a3bcc965
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 567320cde9de5538333f423893a0af28ab9f27d3d5d9afb711cda90b7ad1b87a
MD5 2f4f4cd92af6e9fededdd3eee49b0085
SHA1 41e4a75227f2c8636adc6658e9825cc957ff92b3
SHA512 03eae177c00c766263a71de58e229e3214469c06dbc552f2b051db255a739c3c6a871b4e59c3c67edb919916f7a4bc9c2a2eb485a3e9b2ef1c497307ef5f8721
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57f3d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f3d6.TMP
Size 1KB
SHA256 1e199490a37dfa20b77595a4954c9ef16a593aef61a067635bf2554fc8e7a7cd
MD5 6e9fa12d4a8caf64644dce05e3a10446
SHA1 09d74d98137c7c8368de312f397337206f334882
SHA512 bac668d68ab37cb8c402c35428c1b041c41f4114fb6ea11aa8156a287bb9a05e3e32570ecb8963ad94dcb5c6fc8c266d1b1f127da583533f941d22012906468f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

e41b33c8-f7aa-4697-adba-2a40e95e2276.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e41b33c8-f7aa-4697-adba-2a40e95e2276.tmp
Size 4KB
SHA256 8ac6a58d326a76588daa9f2baf1566f2d20809f253f4ff0ed8b236036cd9e718
MD5 0ebf81d601e77b72402c75d352d14da9
SHA1 89798a149930bf66c8b41fc5b7a3a4e656b9272c
SHA512 7d26fa945925f6590958ad2468f08306831b260d284e2eb006ac284ada345bef7a036b5c5964dfdb0c1e158378ce3284fc2dab3110fd54b935131e36130c8737
SSDEEP 96:JWntDL6rFibU5543CrGjGyGfGBG1EYGNGyGAGIG2dGdTWbfGAdGJGmm:JWntf6rFibU5543Cr23coLY2jz95zfRH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 88157757582b6de02402c00e1d81b9f0eaee7b01816cb64732d487c46244e7a7
MD5 422a2780f630815d65a27f5f9b495262
SHA1 cd7d0ebd38e85215a61ebdb028f21ae7edd23f8f
SHA512 4cfac508c3d1378865c17ae1a899614e1a52d5739f8b14e7dc2f1b1c689c41dbc02fd6faab0b7da2b700d20a743e37f4277f6602fb8a000220f5a0678991febb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJ2De2RUkRH61K3wyr5u:A9iIxuERzA83h09RZxYs7CK95u
MD5 SHA1 SHA512 SSDEEP

Submit Download