87140e0d2551e74b811ae991edece3eefa6a80434ffc98ee44900ea92a1f90ed

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_314f6686ec5082ba79c1a7fb505ae44d.html
Size

84KB
MD5

314f6686ec5082ba79c1a7fb505ae44d
SHA1

cf77612a3c6d364f7db8bf9d9c5529463b58aad1
SHA256

87140e0d2551e74b811ae991edece3eefa6a80434ffc98ee44900ea92a1f90ed
SHA512

a5574cda607dea98736741cc17d30eef3169d59550870d6838d5d146b933d1c2ffc2646e42ee1f8e4759d7b473c7c5356ca3dde197c2911477406f45b7d26a44
SSDEEP

1536:VLNCGEx04G7E63rqwC2H8ZFpITX69dNGO3kwKTlqAbH/JE:VLNWKJ3rqycZFpyXCv3kwIbH/JE

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
1668	msedge.exe
1668	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe
932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2440	1668	msedge.exe	83
PID 1668 wrote to memory of 2440	1668	msedge.exe	83
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 4688	1668	msedge.exe	84
PID 1668 wrote to memory of 3956	1668	msedge.exe	85
PID 1668 wrote to memory of 3956	1668	msedge.exe	85
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86
PID 1668 wrote to memory of 2744	1668	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_314f6686ec5082ba79c1a7fb505ae44d.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefdc546f8,0x7ffefdc54708,0x7ffefdc54718
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12042481250606172923,9699110881737103541,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
3ceefca4dd5f4b5e02bb60d5c3bbe2f5

SHA1
998eee5abd47b4c32f162eb5f2db0cd63afe3328

SHA256
b4480dde794a79c18f497428ddce513f06d4fa8c5019cbdbdf36f2eced550954

SHA512
b35e005afe508ff9d9217120a11cd5e6dc5ed8f3fc305910b56d6b61231c476e42c81ed9b34928c83b67eb2a4040abfafd7329d17b08d16f8d5ed4b60c3689f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
9e3f98308372e81d4824dd60449b405b

SHA1
63a18cba6ec78d24d512b04d423744c8f611e226

SHA256
64522ac4c19fcf45c5d16ab80fe6469b1977963cf8d00f11dcd900cbae61a77e

SHA512
db405a6434ddd31d40c37e621bf095b7adf3ff592167ad29e9309a4395b1f813175bb8a6015b8e1c6a724f4479e7d8cef49cb040ef40826bd16a6034fa8ddec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0db44dd7496a2002b2a4f05c402c55ae

SHA1
e024f3d20dc177bf5c07c9cf297001c24494b6a1

SHA256
7f06910fbca57cc43f027eb37f5da6a71a12b48fbc8beca71478e2ad8f2c61a4

SHA512
b97198e6ea7e1ec621f93f53e2ec1cf07400bc1fc667a42c5e886f2df269f9f59a9cb407dbd4d12a2dfcc6fc411e884795f99962963ba8cf5d7a50e14c2d0127

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2652d59aac6e2db60db8612790c67d76

SHA1
9217e65b529ccd74edf61fb2518f0ccba9b92b07

SHA256
da7f3192fab9c12bb97ed767e1638e6d7c057d27154b462da6f8af764622728e

SHA512
20e7a58f5dedea769a94b8dd0eae06ff50a118ecd61877927533fe134f6eb09a7a14b96bad3bdef995af79b8894e6bd3a160612acd2de630181ca297f421f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
196142d927c495d0b15afe5ec1d4ce98

SHA1
3f38a13d90ff97ea6797a615d49442db83005c78

SHA256
e90d67dd2357b73d4408905a15e074c88ef1a4efcc9924666ba132c0f56c6997

SHA512
e8e6b9d17dbbc84c89979111fb8030b6edf7e6d148bee450be87613a1535e6c4163f51102bce720e57a1bc5df0deea4f9d2516c23b21efcebd39348ab31afec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ec5ddd226a275d336499c981506e7f89

SHA1
856be0246be4ae41497d0f3956a5c97eaa887ddf

SHA256
b0e0520226522b3c751dfb759b3845ae51559fec4fe1165fe778286025b31996

SHA512
2263f56b37cc81052e0ac796ba2c64e435b79d9cd9d7158d88ff1c3440d04adc4584657adc7f2f0978a4a31b6789fd56ed122fced5a62c1a2afd9f37820535ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
634412029c5e6480ea99a0f90f148dd8

SHA1
5ddb9e0e24091b78daabc6bfe556751c92a3f531

SHA256
d7d5aaa34ffdbf2823546116acad64ac843d2ff2c8fdf27e5615950c5918b83c

SHA512
9361d9381876b392141adb1bed3a3ccb29bb9773a3d4b2eab7b60127cfa4cd9a0a391d6e1dec1d9fb1ca24e8e1ebf282411991009f0ffdd8ea503766025d3342

Download Submit