4cbd1255800f27b9c5beaaecae3aab59932f1f6162c56706175424063fa6675d

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71de83bb22faae4874104ca1b9e2395b_JaffaCakes118.html
Size

60KB
MD5

71de83bb22faae4874104ca1b9e2395b
SHA1

25e4cef26d4c0d7d36d10f697502c158c89aa362
SHA256

4cbd1255800f27b9c5beaaecae3aab59932f1f6162c56706175424063fa6675d
SHA512

706d2f078d9f7482486cb4dc5796f87cf72c63c4d6fc3deb9733771f6ad333c36eb187e7701c8827b21dbdb1e5a4cc972a929f374104548f6adc124e4085eb60
SSDEEP

768:1umdWd3e13961tsiY3GWJIQbQTDpZbpR9ecby+2bcdl1MrOOLre/GBZ:1umdO3ZYheVD/93u+2bAl1MrOOLC/Gn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{716B2B4D-EF32-4EE7-B2CA-BBD2257FC6A3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
4712	msedge.exe
4712	msedge.exe
4240	msedge.exe
1392	msedge.exe
1392	msedge.exe
4236	identity_helper.exe
4236	identity_helper.exe
5228	msedge.exe
5228	msedge.exe
5228	msedge.exe
5228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 5116	4712	msedge.exe	84
PID 4712 wrote to memory of 5116	4712	msedge.exe	84
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 4916	4712	msedge.exe	85
PID 4712 wrote to memory of 2664	4712	msedge.exe	86
PID 4712 wrote to memory of 2664	4712	msedge.exe	86
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87
PID 4712 wrote to memory of 3948	4712	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\71de83bb22faae4874104ca1b9e2395b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd421f46f8,0x7ffd421f4708,0x7ffd421f4718
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,16154669264941553986,18348689806166783014,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d72c0b2ce6d9fbbf2d970d25badcb843

SHA1
495fe35c6bc51d822db0d2c9fd6e53019ef457c8

SHA256
1209a5ea1229dd31a26e4c0e39907da2054870ef087adb40e0114ce5b5d31212

SHA512
a65d05450a8f095673224b227aaa7d673905077aebaa2a53a6da1312436bc8f72699acc8778c38049ef24c9aa00d0f79f4d0d1740c169b76a7f823b3488b5074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
940dad69fa026aee5d82cddc48724065

SHA1
fbef9443b9ee5f14ce2401e666b75baf9edc62b6

SHA256
93dfde7f903daaff34574ce656ce53169e2997c7426af7f9af406871534985ff

SHA512
275c6fc32e0de8b6af0e46927a425660bfd7985b7ca6198fbd8bd0427dd59c3c34237092364ee6c74dd934b6579f8ecd1277af5fbf078f5643d608316d73caf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b71bd7dcd5c9ff1ff97a5abdba2d2906

SHA1
0a337179f31a3f6355baa21a8f8bbb1fee418439

SHA256
65c375e975e863084cb6edb34a5203d778991c592dff3ae3ca0e6e0568f7e7bb

SHA512
c98108e4ca02a41842a09413506e1191bf248eef3c52fc605beb04d1a0bd2b5fefde75a857d78ad76c3300b560743387aa17586b290a0b2b368b94e5e53270a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9668bfcbae87db5cec80950d270ce8f4

SHA1
5f8093fdc85ad03b1fef57683136b42c88c779ce

SHA256
d156f157e0f405146b5045474beeb24d105f3319d6474473971202c3fadc2420

SHA512
7c45801221ac32c7bf500fc7719634773a9e750413997eea5782d03093a62a6ea66f4fd88e7dcd433ec47a4ddac334032888b547a4e5bd5ef32e0429a5b97cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f866541a498fc94d3af7d7c0bbf7ac1a

SHA1
db98565b7597debeb15633b60e3ea5a33f15f8e3

SHA256
ee25510dc2a82f3a7dda1daf06da5e49dd753df4395d1e14f5b3b209857ad963

SHA512
ded19e42a94c4a549a6d5d4749977cf9597cad834d94d24564e12eb6a09570c7f685759cfb18feca2498bd837ca44e85c238aa84d754c09a6303e7a4085d695c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d3cd8d08925a845552ad304ce3ad5547

SHA1
55521a70f7591acd7904454eafb7c8f7ef13f29c

SHA256
d0c6e5991655a08686e4e3450a6d19431bc83d912a182a80e3b48b83e835debc

SHA512
7e719d9a8f84922a261592d1bd0f9b06bceaf47b8d1e0323294096640d8e0af24366b5a331b0219ec99d1af6a931fb1062f3d57bedd69944b8f9b288a2e099e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0f9de950600f39b94c4417e62e6eb6d5

SHA1
4790e8ea2d5a780acbe001dfa08fc91e8a5cd6f0

SHA256
eeee958caddad95636f51c15872bc4b506fae27e877acdd471483dfe6a100978

SHA512
755b112637297a04400e07ee7a2a6e2eda36d8c3249a0d0af2b8fb62898a5c4159972e7b8d6129c5840f75e92995b059b9374a480590010c1eb1f9143f11b40c

Download Submit