ecd7c2ff5c39cdc53e511b38fda7754359da42e0bddc62bb6554209bed9f369d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

130ad77362fed0da6232f572b1e88838_JaffaCakes118.html
Size

29KB
MD5

130ad77362fed0da6232f572b1e88838
SHA1

1753d13e47aff3cc495c41c7f8cb5c693926fa16
SHA256

ecd7c2ff5c39cdc53e511b38fda7754359da42e0bddc62bb6554209bed9f369d
SHA512

35feb3422106f0707aa029b30f0b77b5cb64d23a3e88dee89d9b5884d15153d3328b4422f52300bd42b6c3dd92fa1c17df439d606a43f8da70f24f9c97677a78
SSDEEP

384:BZYsgQeu9Iv2LsN6woqQuIfxsv2vJf6ID6MDVxKnX:zYsgQeGlL1woqQffQ2BCnX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540404634-651139247-2967210625-1000\{2B8ECC8D-D9A1-4F9A-BBAD-E80743CF407C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
1396	msedge.exe
1396	msedge.exe
4676	msedge.exe
4752	msedge.exe
4752	msedge.exe
4664	identity_helper.exe
4664	identity_helper.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3128	1396	msedge.exe	82
PID 1396 wrote to memory of 3128	1396	msedge.exe	82
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3680	1396	msedge.exe	83
PID 1396 wrote to memory of 3588	1396	msedge.exe	84
PID 1396 wrote to memory of 3588	1396	msedge.exe	84
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85
PID 1396 wrote to memory of 4496	1396	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\130ad77362fed0da6232f572b1e88838_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc0446f8,0x7ffcfc044708,0x7ffcfc044718
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16108079519016435327,16868231599533843225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
825cc953b635af70ce2c1b5e3170ae57

SHA1
ce1ccb71a67ec2c459fdac734e35fb84f7e9cf72

SHA256
880e06dde642842806f157ed4dd84c4e19bd035b6f3f7211ed69e5219ca5b6c6

SHA512
67fcb5b796a736ee9a0840be547f4f758d5dc0887dd0f451fc912fbbe095eed7ecdd24f62d3053711e6d0725ed67439f0c2fa18f72e7cc6686fc9cb35e02102a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
01c1609c8a1badcd6d06dc262b821fed

SHA1
9e57785944fd0d7cc088dcafb0bcff87d741cc5f

SHA256
c3f58903e6641006701f81e4cb591bde577343f3053609bc1800da0897586c1a

SHA512
c1d7079dafdf62d99a80dc848cef9cff37a171f581c6163604563dc27d0e288de38c03c238ef9e243a8cdca9eb11ebe6784644f506aab52c58bb5f3f5f37d53e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
314093141bf91f886e80591c9023e955

SHA1
4985f8c5012ecdee6ad3a3466ae0c163e27b9cfa

SHA256
9a7ce1119c1f35b5cc02be75cd0481c0596d2cbfff68a6f7ef4aafdc7f0d1d61

SHA512
8a42ce5758ebc28d90b9c4aacc997818df2346feae5950c6ae23d9959b41901fa9f40b8286e1e729474366b5507221e590999e14ca4a2ef658da850a5accf5c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
eb43d614dfaf3dd265463d6d4c105d92

SHA1
3009134f2c34fa2876e172980515b64daab2dfdb

SHA256
3eea64f7926ec5bf48ee44207d9066035ae906343c7276ed6c17ca981c972905

SHA512
d9584a564bf4e1fa3590482c4ecc37601475b225b186a69215e1b70e07fb3a96d462784defa0d020f4c6b6cce959dd99d2555d3cbd6174bdc12b2e2e760e38bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c858a7ef66a9ae44657992335ba2e3f3

SHA1
a78ca50075a792cf8419df07ad6b373839be2f34

SHA256
183bba800b0ceb23e6a84167b71e43c113bc4a4e4046e5f66e0b9746af9b6ad3

SHA512
25ae05ccda78d273fefac9da32b14ae5075f68182f6b11d1ebce71689ffe77e8032a394bdc08b5e4b721caa9b791284c6df2609a7d58a2557058e0facaee9153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ecf5f64e517cb0e44f4330e857ff9b57

SHA1
22799f028582d01d1f0dc62511f0f84feb25f70b

SHA256
b8ba869fa37bdbdae16345bba819fb594076df5303adc392f3014a876fa03793

SHA512
61fb779b23dc0a7aa3c0a3ba73ff172a7df1e0774256f6da9316b22e15972e4fc2002cf5f20f4e9a765a0eafc0b659c2962a6e9dd15e530e6fc46e00db620f69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2e0a5957eb98be4a09a0b58be0fb0214

SHA1
f2d35ff8e6e0f54cbe1f6ad20521b3381944a25b

SHA256
7f11b918f6d8e80281d9358df85afe3d117b188e4fc04407ffba6898e061ad90

SHA512
fc840014cb8dfd87f246dd8ff9f77c985a7bb54a5be2d63fe81dd4d3f0b0fa6df1f2e7931f5c835cd241d16728be2f5510e43aced1f64b781d5be352cdcb3e3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f90261a1153ab8dee2150ff366505288

SHA1
8f997ca6641a73de5a6b44d041a90633f081c464

SHA256
33f3efa3da084ee2af9d796cb1f09279f24178b11a2f35deb130ff0f61412fba

SHA512
2feabc35a6b058f94f50e1cc06c740d7dcc0fe9f292bc121b9e0aaf6e948f1bd1cda492e32033a16f6613417530e82d751fd7403dbdd4d3d0e65a770898940c4

Download Submit