31a6c4625ea253b221fb2c8b8aaffe8f5707288d20f6d393cf087bfb8a2c098a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68ef70446d0568760e62f72ca0e2ada0_JaffaCakes118.html
Size

160KB
MD5

68ef70446d0568760e62f72ca0e2ada0
SHA1

557a2ce81714a5d1a47753d379b327572e38684f
SHA256

31a6c4625ea253b221fb2c8b8aaffe8f5707288d20f6d393cf087bfb8a2c098a
SHA512

14a5713d6d0324fa4e8e2b32c07fe00e713b5a6a6ce870838dd1db4bb600c9fa3dfe99de4212cf85306fec7801224f22e61fda1e48cf54b684c7171b3d37a04a
SSDEEP

3072:8kclAGQkufXod1hG3feApytos2R9ZSQMr+w14zSJCLSu8ortxB:8kclSci

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
1976	msedge.exe
1976	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
2524	msedge.exe
1464	identity_helper.exe
1464	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1560	1976	msedge.exe	83
PID 1976 wrote to memory of 1560	1976	msedge.exe	83
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3024	1976	msedge.exe	84
PID 1976 wrote to memory of 3492	1976	msedge.exe	85
PID 1976 wrote to memory of 3492	1976	msedge.exe	85
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86
PID 1976 wrote to memory of 2632	1976	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68ef70446d0568760e62f72ca0e2ada0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6ed46f8,0x7ffea6ed4708,0x7ffea6ed4718
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15198867388577179175,5471874992167693944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
b0de46376f8ad2c2d16280380b5bd25e

SHA1
126c0d00f24a69e499691050de58c597937b9ff6

SHA256
e133d42abeca856dafad6c2e53468595fe6cff33860b5d9eb810297e96bd116c

SHA512
9a573e2d6a0f1826f7815ad76f481be256c3fef4b0765990c74b0974c4a570da938c3954dad135707ab894b3f8aa3ceebb1d08e91e69e8701bac1bbbbffa6dca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
5842edd73eca877e2a508180ea45d2e3

SHA1
8a4e8e94cbecdf10abd9b17fb8ec603baf39cd74

SHA256
d312a13eb3aac0395ac6918443e1583c3c4f51c569aca42db647e34cbafd35f5

SHA512
2fde1600fb5568dfc9550e4112110cb221104593fd9b7048a31e4412a7a686491cfa2b72addde5189c40a6f5864e5075706dae3ee6878452000d62436bff0dde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b54e4d150a8fce0e6966bc99f0991f2a

SHA1
edf07d970f3088102576193a5b7016e57beeb8ee

SHA256
1fe994050e91a20ada602a3f7c45fee1e233b42e314aa5b5063c5c967bae48b7

SHA512
7412f384f332abfe58bd93c24fb3e64524c85254064d77ff3a3fb9243eeeae3549323980cff9f061c9dbc44ac3d34d5a2b1d7be4e661a8729a71b27ec463351b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
601b267a41b0789e3ac81513ae55257e

SHA1
be6ef3ae51c52cfa97a94cfc041671062ff9fbe0

SHA256
df3a28ea74b774fd4d38f1b30db110f7d49e9d9da78c9e8286846a833f7ca851

SHA512
8e890da2fa15644b82ee13e36d16784de7c0f0da174946e96aded2187455cc69f0bf54d6726f03bf9a0397c17ffc5ccc3fbb30b498ca3f255cd0b8df09122e64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e0e565944eafe0d702f585612273de87

SHA1
71aebdf2aed376ce8f03d417eb894fd0c4ed9cc3

SHA256
baae7c57144d179bbc5e804ab8139d6fe62e36e80fa79d7836977388c618cf08

SHA512
08ec58614d9d98a1ab5090ceb0d00f2bc76fd92086c699245b7d4e5349a258157dae26688a37e6ae972aef8b60f3a5cf1fb40cda04dd4102156addd6ef266051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
937a261a710574d60f03435b595f82df

SHA1
6d6f16e19f7acdcc7f88dc3fb0f4af2aa01450e3

SHA256
2f714061126cd50ca40fecd11c9abd5df55fafe5e30fd580155965c97c1ec352

SHA512
fb2372a2bb87e95c0eba337d8a190dceeae705be1866e841beb6a9db2d41a44a93ea082e7fbfa9e1e0c3dbb079de7260909a2b7890f81e1c11898f6076ed8681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
d0f4c4ecca0e9c52736e95931273737e

SHA1
b403fa71fd7014df124c1eb49df0d0df861a8cee

SHA256
189748e2b4ea8ed1338cb55318a43eab42d5aaaf43420264eb0d02cb693ca76e

SHA512
356441455375d5a1faa166cf61fbc769b74b8159b8961cb3d173027b87705815ada82d135f628aed24e7fdcc20f1a2efa79061eab34efcc8b8e96eb2391e05da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598e8a.TMP

Filesize
203B

MD5
3473cb2cf226da99b9d3f31933086245

SHA1
cbfcc39d76a3509e1ab4dd576b85ee663ff6230f

SHA256
49d870d55fc79b4e8be47fe6c97cfabb0e6bad039e0eb38e1b84397064b7e7a5

SHA512
5b249d00d1cdf84f657ccf99148d8d43ba68c602446425e9f6466ab0c699675315bb62c82284b0db64881f25ca0d556c5d9a867e64fcc85bb74d9c3c8710f2a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc8cba93bebe956e80a62661b9d1f2a2

SHA1
dc4c1d01a3188491ba82150a950aba200d35f968

SHA256
74432af34eaffa0493a0dcae90b73927e7c50b06d44e115e398eb528ee5d1471

SHA512
bbf6fd1969e64d45105ad14cbc0d22641125998457bd8debf3cc1de8b792217b2fbb3ad3a9d96192d11c7de855faf617d4d018315b42381667980925457c79dc

Download Submit