c013d9325280a7883e0e371821578833d8ad53b2d2e8b520870bd3cce5d8e7e9

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6854a24132d278c0dbc1d7484fef1c65_JaffaCakes118.html
Size

188KB
MD5

6854a24132d278c0dbc1d7484fef1c65
SHA1

80a81a6187c895fe2d0fb30806cc12cc7d87e661
SHA256

c013d9325280a7883e0e371821578833d8ad53b2d2e8b520870bd3cce5d8e7e9
SHA512

bcfec20e6b7f29a63edada8f1c5b3e46329e601e1773d01d3c847d6c5f74901060f212afe0503e4f7dd88ad7ce0bf0961bed0144282dbe882ef14c4880b28f58
SSDEEP

3072:wPipoSL+QK7avm874Oqh3CP6jSoTHHQJvdmK59EGnJ09FTFXBHesMwWchEKE9O7:Rxah3nKXAN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5032	msedge.exe
5032	msedge.exe
944	msedge.exe
944	msedge.exe
2476	identity_helper.exe
2476	identity_helper.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 944 wrote to memory of 4064	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4064	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 1036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5032	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5032	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 5036	944	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6854a24132d278c0dbc1d7484fef1c65_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe6c446f8,0x7ffbe6c44708,0x7ffbe6c44718
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17278124577563019258,1579457483824905308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
1dfe19ca7646cec5f613bf4ab82ce011

SHA1
8bbf4df953ac0058542f8ea1f486cb7a7ce14525

SHA256
c97abfc0fbc46b95623818d23af71bab989bb03b33a20de2c727be16706a78c7

SHA512
41326e82c4e6d636f56b0865d1edf8bb2723561ffeed1c3bd4fa3b369318d5cbeef1edbbd999d4c05f31a1a9f604bb2232ee293a22cd38d532ae0137e0f56f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
0cf7be30e9c99c34cbd6f07ebb4a3592

SHA1
bd6de748682d03a7745e452ee1cc98c798b3d77b

SHA256
275f963bb88628fcbd350fa3880b70b0e92a4d7817f073bddd2cd9d65b7404c0

SHA512
542ca6f3d308008fdf20b62d06ef18eba847540dab5b97cd4ba3caf0ad9bb87ca4b25ad43fc5532182ad7a8e96078752474d15387f61038776335b54a914993f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5615cf04fac1faac7ba94f23b87635ca

SHA1
e437a676fd852f6efbae6f690d92db45de7c24b7

SHA256
c51eda435e5b13c9016ec63211242f815515b026ec0abebaeb829d6bfd7c1200

SHA512
6d582bb2ad87e6dfdeffdccfb96fb352930597a8f196a3f4b1820433185d23ad4a78720511354abb3b3d505f34b4fb6adb145e4d7de9948921b2f7374c800111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9cf7dcd97025ab828db749507349c86

SHA1
1b76b20cd7b83c69fd16a44fad53fb0f86541f5b

SHA256
bb6b049366d035afb6b7a298cfce127bf52047bd313ffedfd6ccb217819756d2

SHA512
a34ad2ee1622289ec3e55f4495e54e8bb7fbf6d0fd48df5859a5fa70fb784b068cafe4c209358b87196b865755a5359ba37ebacc9643165d144eb0909b07fb7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10aa95c77b83be5572551aa67f86d20b

SHA1
041b87995735045ec571bf765ab3b937a9dfed90

SHA256
55725339dfc8a3197760ffa38bce2ec4e4b6db4f573335a8de5aaf880eb75a26

SHA512
9967ebe8611dbb202a17a255e69419cb41d9abf1347e56d11f5c8616298f35406183fa64bd85c65ab45bfc05ccab9cb8cebd2798c25ea458846a3d0cf04e0744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2dbd7db4ea3387453fd0fcf5e5c21af1

SHA1
9058cdc12f11ac255ea4ed8c5e51d1028d07d4ec

SHA256
980737ca53afaae76215aed86a9a3e5e8a2fd25d7f8b0619327a9df31d15e966

SHA512
f95832424ac5abc819a1d433ef4fd99c5453ad469dbff2a140be2de6bb2154c3a51a372a698aa0cf10110ae1e414f14e584edc81fef1ac614e7d4d1acde73fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ba55bd22d7a8d622617b65f4ae79978

SHA1
f1bd52505e65faa71496c5278ec8390dd24ef6eb

SHA256
809a40f729fa0af217bb274cc8dbe4f6913b8c40a2c324242d2b2247129310ea

SHA512
e2b61c1492afd3023ec71b76a987a45f31826d6b8842c3aad5f9d8f7458e24bc7113afd28dff55cb8dbf30fa6922e8b369866930e73ffd7246d8aee9cdf2f2c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8bb6700-0a3c-429e-9bbe-58a8b2288bac.tmp

Filesize
11KB

MD5
5f1cf496c94f9fe2524c33f2ac58d2ef

SHA1
5d144a34984d74ff2f00404e2449ce8c906ffbbf

SHA256
fcea63cd0d93ff74f5f0f8e5df3e42ba4d126317236e517987edbabf1dfaf07e

SHA512
28b3b9d2d954e1bf89dbcd3527a4309bfda5030475209dd7b5d69f5e17eb8c50603f28ef23d1ce7196dc56bb68af2934cdcdc0cff698da94850839ad348e5fae

Download Submit
\??\pipe\LOCAL\crashpad_944_BFYQHENXPGHXSDUV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit