081b9e865ea230b40dcf9b1f46459a46e6c3d2f4662666069ff19ca5703ba9f5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ad74e709cc70312a32c3626fffa378_JaffaCakes118.html
Size

43KB
MD5

63ad74e709cc70312a32c3626fffa378
SHA1

3d823bc4f4c018bcd5b319085a8ff6870070fd4d
SHA256

081b9e865ea230b40dcf9b1f46459a46e6c3d2f4662666069ff19ca5703ba9f5
SHA512

07130dc7fe997758d3c0a4748d49e76e03f62d502cfdc6447cdc04955015adb3e7d3e1266d2ed4fb28437c2a6a6cd6f4c064d0fbb8d72febec3d0af66b7eac15
SSDEEP

768:yBod+0Edi4xsSYA7gIsJL0eNYGYfFoAxcWn8fve50yaQ5C0V81d7TppA/BcEeQkd:yBi+0Edi4xsSYA7gIsJL0eNYGGeAxcWE

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1220	msedge.exe
1220	msedge.exe
2456	msedge.exe
2456	msedge.exe
2668	identity_helper.exe
2668	identity_helper.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe
5876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2456 msedge.exe
2456 msedge.exe
2456 msedge.exe
2456 msedge.exe
2456 msedge.exe
2456 msedge.exe
2456 msedge.exe
2456 msedge.exe
2456 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2456 wrote to memory of 508	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 508	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3568	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 1220	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 1220	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe
PID 2456 wrote to memory of 3148	2456	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63ad74e709cc70312a32c3626fffa378_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb923946f8,0x7ffb92394708,0x7ffb92394718
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15967964542168330029,5615793205209316137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\688088d9-1a6d-4168-81d5-1e9092fa0bbb.tmp

Filesize
6KB

MD5
f5c62f79b57944b168eb250e6ae053ba

SHA1
dc61c1f8b7420abef364b23749db6726a56cf08b

SHA256
2392e0a1699677e950d0ad51e721d12c58d03a681497c6e9edc761386e6fbc4b

SHA512
18eeba469d5c05129d6f5fda19e10f1901e41e04cf6de3fbbef4a2e45778c21e101ccbd0c9fdb5c77fb0835385bf17699d5606ef025715c360305b87dddc2c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
93fb5e4b9dd5b2bd9a6864499f3ace4d

SHA1
6d00578935ef1cef8243badb88b4f70ea2995dc8

SHA256
394e33332de68dc0cd3ee0af5c6f9640c7ff9a16972df58bfbca855b3ae981d7

SHA512
5daf0ec52e114433deb941b2bf698253138b99ef92e81b964bc3a7960f5b50cbe975652298af97617c3c937e1e3a9ab75cc4770fc2812c50f575a912c9240961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ac0a15bcf528631229c803fa72f216d5

SHA1
b8036ed7515d82c3add0f8bd4a52926674b1a13d

SHA256
733a422e4ec1f870fb722df423cbbfaaabf270113ba0c6bee1e02ef3af0111f5

SHA512
01612ca90e2c4e082552e692874aba04ad109d6cdc44f7d2ae6df1a2007a5075cfa56271b9d1a22bcc0e1a99506710896dfe99d8b7f634ee982d5eb2b19b72ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
54ec490341407b41b745b9159b8bf1bb

SHA1
0cf37de705e9e183515f2c28f8acbf7c595516f8

SHA256
79477b434a553569616c51ed5c28ff495f7823320b4a7df5783b70750b6456d6

SHA512
3a005aef294286ddae57cdbaee2fc33338ea34f1529b830ddd8c6cdf6aecf9d8ca708b196298319771449ba2341c09943d0b2df480b39093fac10cb5814ef030

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39f5caaa36d8e39c32b70aba836134a4

SHA1
a0a1be87e1fbfb64b6f6dbe7c965276ce1362d82

SHA256
81b3a427b07762e7e2c5f334a4c275cc705d67a73faeec7b373b317c94fe6b90

SHA512
83efc02307294f24bedf6ca0a12aca6bc29e2b3f1a1750d4ec7e2187e2116523ce7ba555184656ad4cbf8c37c532f04cd56a103dc487459882b43e0383d44a19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a0a1c86374cc5bbefa96999a15aa68f6

SHA1
f3824342f10ad508d633adbcc7c0f1f718b4801a

SHA256
ce1f652315339a6217b450f229f9b85b5febecb0f88350f74050d2df3d04b9cb

SHA512
cbf1cbe95e599c862e3dd4b1536339218df08eae2a018f85a73e92d77a00068af554c538263585d286c30fc8d00e480f7124268e73adb75dc10f84ccae002088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9a61a34098d8d283261af52650a55f13

SHA1
c1e3e7e43fc7eb306b2dc3e4bfb1f6b09d02e002

SHA256
90bcec6c7267a30bb1cc015ede13d017b008741bb968a01f15f83a62d30b59a3

SHA512
3e4e65ce684266bd079bf92561126d4f39cdf82bad95f819431b6d51b57ee49ce6774eb40d03f22d81f5325b0cbb01e5fecb9810be4591c1b2c667a5cb58e7d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
134c476b1fdffe518b7e9e9a47c9745e

SHA1
9c957e7d3b304501e24da95e81519de517e41101

SHA256
e070da151d4b636c1b530ff7b6ed175a8d77b548fb23f76a6450a96fd34f5b36

SHA512
042c976d5472bbba626b9f0b0db3564fe5bdc3552cd0cf7dbba26b500a2b2ee48cc1a2fcf8a0f20d699613a4e4b42c99a7e753846838351b8e73750d62e1b95f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bebc.TMP

Filesize
371B

MD5
409bfcebee2e1a93eb392477f8c675d0

SHA1
7dd9ec8a240ce39db92e5b2470bdc15164ec09e3

SHA256
51c74b492b74dad44e71f5bb0417f5845226d75f0fdc6ff2f30086bade8c256c

SHA512
28347b3707c206283068476fe7ca7d75c814d780306e70a23ae6dba14d938fe0192194b4e5363124c3ca62ee35e6a864de62631e04eb4ac070cf496968d532ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
038a34f413e2d6dda515a8db9302a101

SHA1
743afbd72ba31158ed1237865acac292ef862f0e

SHA256
dd1db1c1d8c7139128cf22a8fdf51406c0a4d109aa5382f6db022ac034166ecb

SHA512
cdf8866af4c88ef2c5dea36597c451e076b40ba280e3558d535154ef6efa43b0e9543ef6d76b4a00802021b69cbad9de82c03628f6e41a6052af768405d4c7d4

Download Submit
\??\pipe\LOCAL\crashpad_2456_YSAPWRYLWDZYEUIM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit