43586d57ccf71c6d39d8620f2045926c1db6898f6eccda032b4807f4f9f5144c

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ddcd621cdb6e54cb6c711cca26d5e4d_JaffaCakes118.html
Size

28KB
MD5

3ddcd621cdb6e54cb6c711cca26d5e4d
SHA1

761c7bb66ec557e345c940299721c37d72ec0086
SHA256

43586d57ccf71c6d39d8620f2045926c1db6898f6eccda032b4807f4f9f5144c
SHA512

4027ef3d0f9b7362af4bfe41823035f16f7e0bb59efc08e6f4db6ac8064dc96f56750a27c1d83c027bc35c42d123d8b71a7826b7a469150062337478ca55f400
SSDEEP

384:ZDYp8KLUteubcq7Lb60kYQuIfkDKwKvBC3Cub4+KKX:hYp8KLUteiFL+0kYQff2fWClX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{2C090AB6-C498-45AF-B6A1-13119A30774E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3292	msedge.exe
3292	msedge.exe
448	msedge.exe
448	msedge.exe
4940	msedge.exe
2800	msedge.exe
2800	msedge.exe
1396	identity_helper.exe
1396	identity_helper.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 3020	448	msedge.exe	83
PID 448 wrote to memory of 3020	448	msedge.exe	83
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 1580	448	msedge.exe	84
PID 448 wrote to memory of 3292	448	msedge.exe	85
PID 448 wrote to memory of 3292	448	msedge.exe	85
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86
PID 448 wrote to memory of 996	448	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ddcd621cdb6e54cb6c711cca26d5e4d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc41a46f8,0x7ffdc41a4708,0x7ffdc41a4718
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,23128233002776846,13442895651681842434,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD

Filesize
1KB

MD5
285ec909c4ab0d2d57f5086b225799aa

SHA1
d89e3bd43d5d909b47a18977aa9d5ce36cee184c

SHA256
68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b

SHA512
4cf305b95f94c7a9504c53c7f2dc8068e647a326d95976b7f4d80433b2284506fc5e3bb9a80a4e9a9889540bbf92908dd39ee4eb25f2566fe9ab37b4dc9a7c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD

Filesize
306B

MD5
abb473b5e25be19f0b372deb40fd3944

SHA1
8aea6d46afa741ebb6e933f71a97fdffd461cb5c

SHA256
bfc274c62b03b335ba9af0bfc1e15caf2a2d98310f26c4a4432fb39826948679

SHA512
4b76406c271eb317bc8de05805c7b95a6b12da73113678d8a66e2d38d118ad13e1bbb774add7673c909a9ccb8f7567972c572f7696c3ea8a6da97a30eb79cfe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
332e1155099b69c127dabfea4d6f474a

SHA1
5f8329841b8ed89ebbc7c81327764f05dbf4c476

SHA256
64b321b8be803eb36be1f6070b0aaf9abd015f93a2a27433898fddb8afcf9640

SHA512
32757be8cfc4c219597a672805cf09e8c9e43e1f80373085bc24ec8ece28eaaeccdf14a0712cee2f837c73e206055337e947783c0ad7396aee308e120bd496e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
839B

MD5
8a9b39b563f3348902cbe48cf790faec

SHA1
4f21588b9cb92ec386fc0ce3a49a4bfa94ea41da

SHA256
7c371660b417bd6952f456669cff0a456b28188f08826203fef5870f04756573

SHA512
1cd806484586d530ad158d17bba14e2577150ec5cf2b4ec74ff58bf25073dd7496d881db1112a3a35a1ed93c33da6b98c3883b2f520c8017720236352b954e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81c0491cb7b44267d3b8ad14e8f31535

SHA1
b04c38a22c4c8f54841d80f4389baccf625cdb40

SHA256
b9e1729fb5ff5ee112d295c1400cfbb17d870c8636f73ea44ec064bac023e2b3

SHA512
ddffa8b4dac711f4900235794ec26d6c609f9657fdde44d60a07cf71062770d9672b723c1df9de519075e3c405b105722d41ec5ea7dc3e959db723226a68b794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8d5cad1ac60f4e9689cf5a23562b7f3f

SHA1
5f9841beb5305caba4179fdc0021fdca27c307a3

SHA256
7d6b5c9296f303b3cb1bf181c19cc5c0b5b1a6dfda79fcaf8d384b9f92204e24

SHA512
24d055044b7a60bfc7e9cbd6c1a7df4380009fa8040c63f56c624c7afeb314fc1c53e832206314f2159533cdaf1d98f6deb2494fd59ee950a825e913ac9b915f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a0bd99b6513926e1b7aef6816b07f0b5

SHA1
316b758f0542a008eea5c705061b272d19020b4b

SHA256
b271dba92cdc4a74efb3e1dc30ca440369dff2d783b4b13896fc3c2c86227dac

SHA512
45ab218deec0d061d716f46b99da1e791495aae4075c8dc126f58c0f34bdc90d444a8ba97f7a82aa5cb22021eaf87ad2e76b06c735206342b84c299d6c13723c

Download Submit