a610bb5410b570e96fea1adad35a4a75f05935e87b76995108437fdf4fdefd90

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d93a25c6d344569f76c14bc735a57999.html
Size

116KB
MD5

d93a25c6d344569f76c14bc735a57999
SHA1

6b63feb612940ba21a38465bef232aac90795f4f
SHA256

a610bb5410b570e96fea1adad35a4a75f05935e87b76995108437fdf4fdefd90
SHA512

51491fc8102271cfe2e20b9253400515d2279c9cbf3def517255d9a365a2192c7ea872489179e7ba7bf137f1cd4cd93e57ccd917be3b4dee44ec51df410ccb8e
SSDEEP

3072:wl6JnErYl58U+NisOZHvOod8hNBWwd/RNHTcjbS4h:wl6JZ+Qn

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
51	sites.google.com
53	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
2864	msedge.exe
2864	msedge.exe
4360	identity_helper.exe
4360	identity_helper.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4468	2864	msedge.exe	82
PID 2864 wrote to memory of 4468	2864	msedge.exe	82
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 3452	2864	msedge.exe	83
PID 2864 wrote to memory of 1856	2864	msedge.exe	84
PID 2864 wrote to memory of 1856	2864	msedge.exe	84
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85
PID 2864 wrote to memory of 4964	2864	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d93a25c6d344569f76c14bc735a57999.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc45246f8,0x7ffdc4524708,0x7ffdc4524718
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5667347581752998830,14653236923865931166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
600c93e3db884a214e832ba84042b436

SHA1
09bc31a3b588ed6fd367d822b70084f8cd6e41e7

SHA256
682c34a133b4232faaf81b997ea52b9b3ba796c1d634043a322f5b20a330a9f7

SHA512
a0b5fd6a9129bf80842e71248e9f0fbfebd2fc7702dd86eb2f466b71bdd20243eba5c88ebc2a41be37953a7f9d8f9e5c52cd5de93f86d89a8c8a9b7a8d89fbb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
dda0c4d54cd96af64d2629c3f64f2a07

SHA1
97b5f6834452b930fb9dcd880d4d0b5e8c0c13aa

SHA256
e0fc1fb02092ae89ba26ae61f29e99e819ca1987376f5ba113b00804ce58c64a

SHA512
340ccb42ab3186f9ae493b1a9fe939719c7666ece165c97e2327c1eca1b9857bb090885cddb2882ba917bca414eab3ffe42dbe3d65f5ccde002aa20e8ce0d711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fb96805a6d3ab9e758ede6563a6385cb

SHA1
cf8ace0fb2115fe7586054de3734950753471e3a

SHA256
c49e5098bf85ab64dd40746c8f095474b70be798f276d79b2e31ab902177fc84

SHA512
95de28e4fe45dc8ffacd310bb5fa2e36125a13de9f60093e280d179ec3f72326ee4636a9ff5dadd116afbf4b485954c340dfcda8e1ed769d909aee40b81442d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c713b16bd4acf6e4bd283599661081b

SHA1
3cddfc91be9a694159ac5f0b4daca3921aa5bd40

SHA256
2e53ed63a0bb10a23a3c3f4e28350c2affffa319789e462969d00431941f2c1a

SHA512
83feb7271d663e3a243a065e0283a6f94fcd4b0f187356b04417f0af8f2dfcce31f9f5d81bd7e1bab421808863b55b5e5311fb111ae9b87063fc9eedf17c2590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
98f7d8ce281120a9004fc3279e5047ac

SHA1
c50be15ce7869a3d58af16abc64ce14f92edfc11

SHA256
96da03a740081fecb75699f37a64e52bce87dcf7c0d3dc9e5d9e7e7d8f403699

SHA512
84d0d9d21d4dea2fdfc9352066fef3443a312623f259b1b940e42daf7d6cff816a4ff1cc8ce7614e0de02c570ddeed41aa1dea62bbb39fa68536292dac43b16f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
3a2a1f269e80cee985be79681e4f99f6

SHA1
940748bde0fdfb8a7055d5428fd27742d3adb104

SHA256
43d6d86a6cc86b6b0ebf89c2f4adb77c37a35c4a417faaf663c41e3013d1e94a

SHA512
22eff458cbee369cdce371c02b584f1bbc0662407a131efad319e109fb616319e166add2d4f9e3c19a7560a46b42bb281294adc88b88908052fd4f9bd5a3c62b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
59d9cd2c848cd8759580241f03c97fc4

SHA1
8403796ca95a45cf10c44a7c8d6afecea732d981

SHA256
9737476b16106327120cba69cce24fc06ed5c0bf204c178a421db02ec5b732d5

SHA512
f1d40774477309ef087ed201d23d6b70a5bd17b179b60809321115ae64bdfafc95e88a961a2ac10c650d8b40b8b30b82680ef57e984126799cb35499f7b761f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
aa9a6586e988a40803a948e55bf1a09c

SHA1
c828649c7fde4deb37256f418fc26881cfd84308

SHA256
cb40504d22d66ac41f9f4586b49a7c43351d74ca79d3b707c534b13c019ad5c5

SHA512
b727c42647ce8f0466fbfab0f53023c249809871beb77279f2cb2c455d6297ae97263e4fe06c40b92b28851d4bf15047411d9c913b3be07119531e02facbba07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e58d.TMP

Filesize
204B

MD5
0cf18781f6806c43933cdedc1234656e

SHA1
a51c8971c8e28e4d64a537ce44cbc2bb02fcd41e

SHA256
f7aedeccbc3083cdb5696138843f1b8552bc25ad954005a783f0c64162cd8441

SHA512
bc14be29532db9111c1b18726dd1d5297dd624089f2e996f0ed6ffbfdf139b84e3c6e11d1e4f8c410ed3ef473fa36032ffbd6ce1618bb78088fe27eaf79b3cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8b5b54f78a1cf0486522bb2fe9bae6bd

SHA1
6c66c848466385faaad725f9c7791994faa86e0b

SHA256
76ab079cd85e4dc5da7cc2f058119b3b315e84656c6adf6ce23a3c37d36c91f7

SHA512
b0778d6406fc45cef7e3b23d546d8a2c1f05e21bdb7aab5e71597c759bccae98a7b334dc7821fb1ac3502fb415f4496ff254f10ad17f8e3b947a406105dcef25

Download Submit