229e0a0ba0f60fb10b8497a50244adfbb070c6b187ea2c3e87d7ca12b6b5e8da

Analysis

max time kernel
146s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f83390a27b2c8d2e149004f5c0327ab_JaffaCakes118.html
Size

61KB
MD5

5f83390a27b2c8d2e149004f5c0327ab
SHA1

d439b114e5a8e57420a2af3384641ca951cfef75
SHA256

229e0a0ba0f60fb10b8497a50244adfbb070c6b187ea2c3e87d7ca12b6b5e8da
SHA512

daf5d3a77addc16cacbc762660dcbe8192a446165781e446481dadd550c14844ea41347eb92050bcc741e6fd3d99d46467bb42e3c2d453f5644690ee794a0443
SSDEEP

768:/WWerqQwRJWDkwPyrAJJ0D+KAb9Hi+iodiFIKoTYs7898EZ7xmUL0kOnHKFFX0EJ:/WW5/I9HieiFI3Ys7shLLKKFFEEywz/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
3808	msedge.exe
3808	msedge.exe
4832	identity_helper.exe
4832	identity_helper.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 3296	3808	msedge.exe	84
PID 3808 wrote to memory of 3296	3808	msedge.exe	84
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2532	3808	msedge.exe	85
PID 3808 wrote to memory of 2636	3808	msedge.exe	86
PID 3808 wrote to memory of 2636	3808	msedge.exe	86
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87
PID 3808 wrote to memory of 4020	3808	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5f83390a27b2c8d2e149004f5c0327ab_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9531446f8,0x7ff953144708,0x7ff953144718
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8705850636522427615,8972613703812147849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
17KB

MD5
f472746d4e24518038118585a3017a3b

SHA1
2c9f90288d2d54fc06c70dff61a41c56c3e7dd50

SHA256
959d46a2d158d30678310277848c92d3bafc46f2d417b864db6771e2ece63185

SHA512
3b82a94bc5bda6d3f1eccbf6c932507dd003ad5f24d31d749bf8296bd09a170913644cbc39329781a46a335399355acfd08a82ea39549fab1d2410ca2339519c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
3930dcd179ec79a78045d505a0a1204d

SHA1
3e9a0da44db57b161cedc18c78ea1782e60cc640

SHA256
052ca68e7a5c98ad9ac8f1c3de2c049cd77404631ae41adc27139da3b053d312

SHA512
eaac4bce10953afd6d8eec933fe210242d140c151c1fcb83b34d9001235e8849ff652d728cb82dc073785a9f44dd1ccb91e1c926a4f97c7e8c5bd5e65803d145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
90423f423f5b1f21a4865dd3f425444c

SHA1
7f1a804e46cef59969a68c6923376be4c9cca3f9

SHA256
4aa2faba2593acd8114aa7606d6c8f45a319336fdb7102a180cb6f51fb584179

SHA512
7ca2f3c744b19f53f0816c4528fa841800f4fcc961cf1e9cac0b924e2cf261a7e9f4e5f85b17eb9f28c0c210d43bd3c37c13cb3b6e64465ff5ed3d7843ba45a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d88e07cfae8d52e331d09f0b395c9598

SHA1
15b117aed3d8449f5b2203851d8c15fb27b123ac

SHA256
e9859a6574bf98daf276b549d716f884b3a61ca4ca72e7a5ab94625ae3cbf3f1

SHA512
7c1abc8b0a3e0c2cb3f2393e373921dedb2f891ebd94b95d330b942ce4c52af3662c98addf90326285eb984d391e5ce5655f67b8805b70d1c35ac6d68ede7bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4b2e77f962a7144b25c1ce530e72a765

SHA1
9950a4c32578fec38c9fb9413ba124ac626b1c88

SHA256
36dcea159a232254c3f140dcd183e3d8aa6cea90dd8db48efdc5b68fb2063b12

SHA512
454fd4ca3f58674b75be0b8ecf29ccdca55b7bd5000ed5ab190d3c3312d3d4568bb291ea2e127eceec903a53efdd0ae461149d747c997e3c085589fb810bb9d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a85f89ac4d62fc869c267552d3352ac4

SHA1
6b535bfeca82abaabb24608f4b0fafb4081feae0

SHA256
2878d3e1aff2311521c025d09ef0a7a7bebcd169e264e66f4d1b05a32a8c6750

SHA512
298edaf6dded82b277739666ab6050a894c802b185374d1bd46a4bb8714c71e3eb19c3970e268abc13b5f9940cced99735e9319b26eaf59701a4ea4e0ab56b87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
1345d32d3365e509d1d4d3d7e195bd4f

SHA1
7c42bd997c951dabc9e0677fe37701797ee6b0d7

SHA256
9abca9c5495bb9ef3c756cd6c0d629dbef2e921556e7dcca760968313fe76d53

SHA512
b60392624aa1b106c51b9a56973527bd5aca4a100e4f74eb28a33b5dba9e72a1221622f08bf7f5f5c53d8a2fdb3382102292115939b0485f3ed2229ed1175810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
4c98f1e61bac3488f20907471f1ba5f3

SHA1
115d0d5595176b1242568e0eba8e30bbd8f1eb71

SHA256
3d0fecf4b445078f21700e11f1f1df37ccc4e7f5139128b92f7e1de4b53fa5a3

SHA512
55d51f5072678c48c8a02f38f3048ec8c91ea54555d2ad6efdeebc5f1ae44a8679ef4195efbc974330bffa23daccec8f7baa48acef2f792695c0628018a10b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
708a9a961bc18f4070151b1403319047

SHA1
322d598ac144ecc7969fd609b5d62f74686a1e91

SHA256
5e9ae1ce0b6c9d275ae271c539afb65b28b910e29366c60f252a0b619d8c184c

SHA512
7981d0810bda1e5017c1baa10ff2991aa8c70eccfddd926454265d77e564447c173cda72f19fe912cf0552527555d7738d693b2ea3cf58a71e1eff3416984822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
0d5aecff6d511a5ebe1b733e4355d8cd

SHA1
b264fcd70f2ce38ca9144c191fd6ad15f10c99f3

SHA256
29f786b52eb225eb2b24a5000e44d94bae88c7c537f0a184d252caa5335e7b1a

SHA512
a2cabba8359e5a31945f54850dc2a3205523d56d8579adab1b87a38a6907af24ec557cc0cc00898be553f235c6930266055cde1d01a796e211da366fb7709d49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d3cb.TMP

Filesize
539B

MD5
ab46781fab0c310f0ba8280e81532a8d

SHA1
e466224bef483581a3fe70d40740e80026747012

SHA256
fc4da97aebaaaba49729ad7cd0536d94c106df4abf6dd7308533eeef8e683494

SHA512
04fb0386c8c2533c501ace853074fc1b326029cbb28017e08fd54ac887999183aa0edc1ecaebbb6b8cd480beb12f0e6c19a278ddc3c93716e0eb16235ee8ecb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e3205d71efefcc83efaa76e24a80fb6e

SHA1
484279c4ba5b5445d75fd91a5bc663352f1e17d8

SHA256
ebaf4eba592f1484afd46797bc9e3c82b3a5490c7cb553b8441a871f69435c80

SHA512
15a7de84cda193b9f2524b4a418dce5888ec80e3acce226cf8df252eb7e5313163ebeafc2057fa0b9da9f63216ad01116f04782cc447cd1c362c278110e8761b

Download Submit