f3209646af1cc56432a7b753b87d7b9ea49098a8c7b04f4bd74c3c21f977dbcf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11a2ae8397e838a45b51f7db66ed3e12_JaffaCakes118.html
Size

27KB
MD5

11a2ae8397e838a45b51f7db66ed3e12
SHA1

9c6525e4f9e49711730b10108960cb2e5db2373d
SHA256

f3209646af1cc56432a7b753b87d7b9ea49098a8c7b04f4bd74c3c21f977dbcf
SHA512

4526ce95fab61fb96cdff8bffbbf8c337a571aa557f363d5ab59e0b55e907b0f2b0690714eaa1f2359f188a247c48eb2a502f641297d69b2d3ae9c4128834479
SSDEEP

384:FcYl/kHypheuQaL0aLSN6Vv/QuIf1HFg9KCX:CYBheH+LDVv/Qff1qrX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2818691465-3043947619-2475182763-1000\{5A16742A-9E4F-468A-B5E4-46CF0261E5C0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
1260	msedge.exe
1260	msedge.exe
4100	msedge.exe
3908	msedge.exe
3908	msedge.exe
4308	identity_helper.exe
4308	identity_helper.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1128	1260	msedge.exe	83
PID 1260 wrote to memory of 1128	1260	msedge.exe	83
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 3660	1260	msedge.exe	84
PID 1260 wrote to memory of 4724	1260	msedge.exe	85
PID 1260 wrote to memory of 4724	1260	msedge.exe	85
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86
PID 1260 wrote to memory of 2584	1260	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\11a2ae8397e838a45b51f7db66ed3e12_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8ea846f8,0x7ffd8ea84708,0x7ffd8ea84718
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=188 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13713941545044742160,16163960434802745233,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
2f8230c6b769f45bfb851c50a447c71a

SHA1
b69caebe7c9bee22f0e1997e8784899671b0fa55

SHA256
edb60a93fb7ca085e81392fc62748df6c15f126a1f49eb261546f5aa1c115c27

SHA512
4bd307804c5f76b7d59ea7869da85af3616869e1273afb9ded25d2b2122d974198223637c15d19ac14152e9df0f76904d9163b9a46d53d3594656d5e1be4e520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f7e1082f472f58e88b6dd33d52009916

SHA1
1e2a8ee12535a52fb93df9c0c4eab86a2aa42f38

SHA256
511e41a55ba0a6cccff654c8858913978b5d343bc553cfac8d48fbbd0dce510d

SHA512
ff8d46f4ca0d60dcfbbd378e533567ef8b2dead1a328762a1918a7b68e05d86c9462dde0c59d9183df8560fab26296a6b3da6e538a4b7847c99fdfe877faecce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0772970bf301d77ae2de86a86755ddf9

SHA1
fd2c137f9e21e097143b03bf00dd6e4797d71344

SHA256
55fce6ad73c93a0724368b8cf176f7386f6ceb0ebda13a84f5a0d0c816bd3332

SHA512
5fd7019948d71cda8da888899719a223c0e939f0a6b82d4755ee3a85e5f7c3993a9b4e22b18aafcc0d306c2fa1d220009d7c3f9ba99a750b408732cdafa342a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1bbf15edb61fd321e5539a41dad9c9d9

SHA1
d6b8d3ff2b143dde3f844d4d9c4769350f1efbc9

SHA256
700d5ca0d3d7e2fbcc02d1097ffec8183e4752a16312cd49de1e43252fc92161

SHA512
368655557b09e68438a4ca8a033c9865f96fd35337f21bd28fc2042b76eb03dd1c547b8929f4681255a62b592e7546fe6e22f7646fc13ee6efb37ea6926daea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bc442aa65107fa03790b7bb2da2b0abc

SHA1
d7f7aa3cd3b9138809b68ce9b1962698052f3c73

SHA256
bc543cdbfdcd506b5dbd47a4d6013d9aeb5c238a138bf24ebca5f3077a1188f6

SHA512
be17848b8dcaab7437794cc03ee82d82e0345893abf4d57388e21b203bc67f5f0dc7b66c6dd213865d1c90565e0dfc5427e5215b4b214c29aad07bbc6025af37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d9286ed6bfa06d6c0d4fb7e808e5678

SHA1
019fa63fff4899982b0dfee0aad3d3592be5dd87

SHA256
14128265f6e7b22185dc18705bed7c2638ca1c5ab87e76d88347a39d7b2df204

SHA512
5a99a4b6a170a1f85d2bda9cb27287ab2986249b0e31b685554987d910809ca0dfe6e3fe46811c96a8f785e8491aceb874418ddec4306cf249749bce1c2c2f5a

Download Submit