a75d5419b6762ec8f104740733c44e32bc5d06cffd26be340709bd483b14376f

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2025 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7df0863db29ce6edc52feb9476394351.html
Size

63KB
MD5

7df0863db29ce6edc52feb9476394351
SHA1

b692a9c35db14c079c56c27f3add7d944008a697
SHA256

a75d5419b6762ec8f104740733c44e32bc5d06cffd26be340709bd483b14376f
SHA512

05cc1fa41dc7ee17f20c43d5da832e1ae115e33a4fce70e5b00bdccba2f260e6c7ec76761088b77c7f078b33d9e15f74c7f4640e378c77ccb0d5fd1ae202e9d6
SSDEEP

1536:iMk5hP2zBHXecebe4ezeneHeDeGeTeHeAeLRPTHltNWKBCK89rCX7CesY8seqeFP:iX5NyBDRPTH9WKBCf9rCX7CeiseqMtBD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
2596	msedge.exe
2596	msedge.exe
3340	identity_helper.exe
3340	identity_helper.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 116	2596	msedge.exe	83
PID 2596 wrote to memory of 116	2596	msedge.exe	83
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3328	2596	msedge.exe	84
PID 2596 wrote to memory of 3728	2596	msedge.exe	85
PID 2596 wrote to memory of 3728	2596	msedge.exe	85
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86
PID 2596 wrote to memory of 1444	2596	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7df0863db29ce6edc52feb9476394351.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabb3246f8,0x7ffabb324708,0x7ffabb324718
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,2728723485570081535,10473889868563029301,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
20KB

MD5
2ebfdbd309ee762211b4a2ac39708c4d

SHA1
b002922c672dbe1dd4caa02af24d0b1e7da616af

SHA256
54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797

SHA512
d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
9d56d8272e2dcc7b76f6335cc7bc9668

SHA1
673da5ec8302e8b39bd6b337993975e11f987a3c

SHA256
6ca6801657d6c29cec4afef0af54b567ef12abfc73dc30e046bd05b1601a3bdb

SHA512
a106ff26b55c85ad1695234fca6caa32914fefc10ecd4ea24e33486113749eeea6e2be5d0d81752b4003b9ffa896cba84bfcbe33d247803e0ac7cf6c25a20690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
5bcdde574331dfe988521b6db015917a

SHA1
b02df95fbae6e4aa602662c6d3ad5a00acc03624

SHA256
5888038fc5a9208ff69ede41db2509f01368145c966c4c69c983214c0b4af289

SHA512
7cea85c4e0e0573b5a1669a9211d2978fbb10d73cbc68b0239bc084638ee7b5eb3672463dcc1bb4474a99029a1434b5908385427c2580f3b936d5bbd5c7722a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8ee40f94a4ec456ae9237c45cf8ba205

SHA1
f195668a47b0ec95f90d241acc0163e46d9a475e

SHA256
27cb7d0fade62fbc1cefba89a0047dbe1728b13d4c76c820bd7bf581f5aefab9

SHA512
f3e8446f54777bc611cbfb4d497e7bf26bad0bf61d000847a1ab9b03cac7fd1631a7a7ef79dc154fe7933da8bbfcbda149f49e2330a85bac279be299da32526c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eb702f199b9a61bd05f41cb4f928039f

SHA1
ea9826704cb48f776e8779f7793f162c05d9d7bc

SHA256
fc8f9570cbbbe97e7dd48c05a3998ec3a635b3eb2cc84e44a53d8835c556f036

SHA512
f368364d99393f7f6efcb275b953691ed598e50444ab91c09b04c08871ee2c8668b46f59bd5a96ea57b1366622c214eca8664e8a43784eea7407b82db811eb95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19c84fa1285a6ed19040c7cb76ebd901

SHA1
be1a5b6fa90752ee3a4869513844dfa51a04057f

SHA256
4a01a57681b5edf6df0f12ee0753dc70e94f75554a8b94892e1e339f0c0fd7f4

SHA512
ae88a0e41c1bdce01826eda798d965c0916086a7cfe9cf8051eec7eb11910b7ddd0fea3194b88e97d68bf88adb14c0e77d13a8f48fcefcb88c56971daf454b7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2312974767fa27acf37fca483951015c

SHA1
9b41eee80c1f6f1b23d8c12843ec74387f921be6

SHA256
221470814e9c0d97e800b01ccb48b5a045dae9a680359265ff9c22b99e8a2e05

SHA512
efc407026d9f87490927c42ccd77d895930976183ab9b5476acd5ebd915fea0574a1a321087a4a9b701dc7ca2226254877fbf0a6faac4566fdda41d3cafc8252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3ebd9206821e38405e3a6c0f000beedf

SHA1
0fa416848317216b7fb64b1c9326d2d3b741c7b7

SHA256
08b2534562a61a224119f0c0db008a4c7e265429746292091c4174bca4602818

SHA512
cd398852caeeefbfe57f4503d70b75518908eae431b832249acc53aa27afd6977bcc19178c6a97f0813c2a6859907da18d3bdcf43febcdc578058989aac64c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
b5c26f9e1ddbdf1e3a1d8a89633c35a7

SHA1
2ee014bbb121a952ca1cbab50142ce31875fd4df

SHA256
80aab4cf90a33cc8343d8d935668ebc7fc14e6a348de0ef182855d476606870e

SHA512
fb6c44cef2db97d1cb200cc0bbf843b2bea2aad4e3861c4f9085a1c56ff69ef73fbe755f0b0a127d0b8b22f1719841a34e1afefd4d7fe74a5342d5b39770a83c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583bac.TMP

Filesize
370B

MD5
df58a30c9712aefb5043b35f5121b759

SHA1
34a3d1738fa3defd9a6708e0d9cf987d9e1a5ebc

SHA256
4cc78d7be549bc3aa835908eb1634e4ab2c21275275754cfc00c6c68a63507cc

SHA512
aa8ade69de4632c944575dadb021e561950df71d92ac903d1a8867d8f696854af56c921551ce4f8959385631b775b7182f36f92480b8a121d4a5bec65c6922d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9b4feb6503a53c2ed4cd259d0901271a

SHA1
e65782b6ec05d1b4b0b161c482cc7fd373c2c928

SHA256
91c81fbcb6271dee5a95f2346d2e99671769df984bded747df401d009b3e1917

SHA512
79778ccbe6d02c2a981afd784e29b45fda9ef947aec7feca30a260107653c261cd62fb136de1d44f581f3ad272dcac17a7fc3f76a6a68d91f98f6c21ae13c0d0

Download Submit