b63a24c72d4cacb33826fa7e78606fec440508046741a55f79a03f6abb3efc36

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21384e2a7e950a1a99ee015d6f9d3b2a_JaffaCakes118.html
Size

79KB
MD5

21384e2a7e950a1a99ee015d6f9d3b2a
SHA1

fdaa45f3a39f54286888a986e5431f40bafa52dc
SHA256

b63a24c72d4cacb33826fa7e78606fec440508046741a55f79a03f6abb3efc36
SHA512

c05d9422710009d42abb5f466a066bf11b0e5cf23e4e9c3755f47da166950815f61f5c1c2bae48eebc94f3599120562cfa63d7cb580d760f2ada444567542b7e
SSDEEP

768:WpTEHEKeIQm8as7NWv9PPeE6pdIXRCV25tpieKNa8a0H3Bhi13+0JJhc9ke+6OMZ:WRErod125kXAJhc9k2L4lRwnue

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
4168	msedge.exe
4168	msedge.exe
4392	identity_helper.exe
4392	identity_helper.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 2012	4168	msedge.exe	84
PID 4168 wrote to memory of 2012	4168	msedge.exe	84
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1536	4168	msedge.exe	85
PID 4168 wrote to memory of 1836	4168	msedge.exe	86
PID 4168 wrote to memory of 1836	4168	msedge.exe	86
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87
PID 4168 wrote to memory of 1428	4168	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21384e2a7e950a1a99ee015d6f9d3b2a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9603346f8,0x7ff960334708,0x7ff960334718
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2960 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12843812575745709475,17349429576440823629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
9c1c8afbbd8c884dbf0a692c4f31b194

SHA1
f1f04913791b29110b39420233943abe3907472c

SHA256
e431cc38f94f9b5654dc176ff52380a0e3b43e64fbb9548257b3599074846549

SHA512
fd3534193b5a53fc1ae99fb91f7b06beb541bff876c03459245ba920cdd1d0ebf39465a71f7e9a48cec0098fbae0e55c66c8965b456c220b0d4b215bcc407668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
28d99c7a4facfcfa03a5fd9821194605

SHA1
80bae7b3831934bbf6a5b7a7ebce8aee99567096

SHA256
5bfe0ab72bf1c9c95636139a8b47d7723864302f684d813f204b08d5bc51490a

SHA512
dfa065180d85af505de469caf20061f2d547a71858e5b9e93b7bed75206744568218b8fc801ef10b59a50b9f435b4962d752a79eb0be34b895751b2b272f651e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5d3e4b5f6da63b1aff592eb09dc6c4f3

SHA1
b62a2c708378638e6af04e84d72d68aa5500fc9f

SHA256
8b1b898795ff5265b93cdfd3a16c3f73cd012f1e2fd089802404271697bfc38f

SHA512
ca8d803894d16d881bcc873e7ad3271aa4fe15f045190ee0933d5bcd6e6fe472f557536bd2748d6d7b1e4910932124e57e097431f30d0ff1859928b5675a877f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82fb5764b85171430dd9c6ad1bb0c28a

SHA1
432ce687427d6d08b11b981cb1ed57c77b05c51b

SHA256
9aac83420c9dc870ed26791905b05a8be1cb53e966293af99d900c4b1d8f527e

SHA512
3ba6ecb4754a700d504144eca1199c3554182ad1a9d3a1477e5e04e4a62685da84d9ee40112a3f66860f27c946745cd2873d98e5a2f1bd535c9e161b0f924376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6f746e45b57791e3bc824bf32d98bfc7

SHA1
7815166c685267257375609c27019f7de1e2c4f9

SHA256
fff4585bf9b50f043ba9e4e83af97fb52407e23fa2875da762366397d8f937a7

SHA512
f7650278ebc75c811759d5502bfc08fa6f501ac47a31f84a1b48db54c8639ea7e45d68ca411882fced426460ca21ec15593a68ebd49216ba8d362a561b59593f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
218f2811df1dda21a717d6b9f42ee2ea

SHA1
e1436cdcd9de648e039670d0dcfb707fd6b84adb

SHA256
0277a2ab37036eaa412342bec8382e4e0bfb41ad9a3cbf6280e36530801ec8e4

SHA512
a212c0154bfc2f63ff2f9af54f65425506e6c882c32d87a7df3a1d2432be262574313978f00e324991da7bb566ba0a590b96fcca32df3b76e60898253502d67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5995babfd377db20e2dfcbdffbc9ccce

SHA1
ca07e26a02f891c2738f7a814e399d9f19a655ee

SHA256
210bc76c62f9d958598971e471d54d0a1b5abf8a4c38eb2c7edd5077af4b7dcb

SHA512
58b971971eff94a355e0903554ca1339bbaea6f64735508e0f9baf8d6eaa1508f577cf1ca11dace940e0938117f1fa697540e16942bf0898446f05537ce3e97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cb835c2f4ff05c9f28ef15c48d176fd4

SHA1
f43aee29260ed692ba07241bb8440cf33612228b

SHA256
89e1285d564092aedfec123c4ef066c73145a110336bbd9e16b8d4c7a1f4d2a0

SHA512
e5009549df18e848491ae0a95295c62f0fa04fe099d034a7f8ced896dcda50c4512e1c6c2c2e8ee217a7517dde02aca2bef606b2d8362d89c05661d02bdc8c27

Download Submit