5f7dea6daed5843ccf3d33267df3d7eacfcebde2815a74a8c5b3444d6302af05

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2025 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_555b0b9a63d137cc299d1d02a4871097.html
Size

62KB
MD5

555b0b9a63d137cc299d1d02a4871097
SHA1

e2a3bbf0435d3064fab7e771642da9b9121aeb12
SHA256

5f7dea6daed5843ccf3d33267df3d7eacfcebde2815a74a8c5b3444d6302af05
SHA512

5fc200133b7837a16a4509dcc6308f80f7adaa36370711c6b71b4547454c49e225e778586abbbc4090ec0ef84fb75e6a12c4e0de1a4e1733980c9b4ac7986373
SSDEEP

1536:wPwx187NJge9tQPgUbSj4kZ3oxjxEsckY/QQrzv23UQvJKYi3Se/s9:wPwANb8bSce3oxjxEsckY/QQkUQRJi30

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4348	msedge.exe
4348	msedge.exe
1092	identity_helper.exe
1092	identity_helper.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 3224	4348	msedge.exe	83
PID 4348 wrote to memory of 3224	4348	msedge.exe	83
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 1264	4348	msedge.exe	84
PID 4348 wrote to memory of 4060	4348	msedge.exe	85
PID 4348 wrote to memory of 4060	4348	msedge.exe	85
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86
PID 4348 wrote to memory of 1904	4348	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_555b0b9a63d137cc299d1d02a4871097.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad17946f8,0x7ffad1794708,0x7ffad1794718
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16511483083423899362,16885659947764522129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
47463f619b0ef113ecf90f842be15d6b

SHA1
fa4a0e6b536256e999f78e5960d9879d8a4e6983

SHA256
4073b1b7f73b92272ba146b8379c88278bd3bc7f613a70eb6bb8ed19f31bf454

SHA512
d9f4a485b14fd0560d29dd025fd1ba74d38830d536e98a530e3c5b85cece35c0724f13a7e6b672a09670561fa57169011a86e48422a5ed3c774f4041274bfa9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1a458384824df9212db479304b6d9ba3

SHA1
eaa18ee2ab3a832ab5790b85f01880d7cffa6487

SHA256
08e994f15c84578342c51caa86a5cdd8a0de23bbce3dfbdea00ae6973e079428

SHA512
579ca2bb13037c29aba5f79e45f1088ebc55c78060438f34ee0c7d8d9cc9ae9859626e29efe4d2212e3b48c7ebd56222452383e4356f4a226a53a72a2646bf89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
21dc432774e70d07e80cf82dee211106

SHA1
aef957e682f1278e9a60d1aa2ef4dd5100568361

SHA256
bb9b82d498e0720bb4a3725508536d3eda75331cbd86b1cdf78a0be242018b96

SHA512
3067de5cdfba6b8b24a851a7c770725ffa5aad12150235d568b9e11f51cbf2aefb61e05c64a31e45b00ab5f22ae74659603c7a6bfae0d8e899787b8f9e882896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d2c69141aa551078ba589f34a2cdb4b

SHA1
8308bd84cdcf01760488db1e3447c1b623ba8795

SHA256
bdc01fbee3d99120ba3680922a7dd5e902a6834b2ab7c5418c2024ee2c3c7233

SHA512
1d50f30b1754a21b32def16a6182392316fd5812ec553a9cfcd73f3df021c5fbca41f1dd30318cfca38cc63849fb493d0fa85b9fb91075c3875495f3404749e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0400648f420836a89d6456dcbf953fe4

SHA1
0e054815eda68ccef44e20fb8cd9bb2e65be4a21

SHA256
b7f321b3f51b37622b4026755883b2663410e8a7756adb016bb09a6efd3bba55

SHA512
b1d7dbfb8268acf8ef96885d6f2241194de5844056d810d705c3e9f91b73bc49e369ecf40dbae4354fc0eb5b6db1713d9365727d05a71999de86b497d08d7c7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d9749fb1a8ae3919271462d1b3f65630

SHA1
a36e7c05ea003b1d024b81b15c181ec7c073e905

SHA256
2d28cbd4823e640514aca3fd65189bca8f3481e93265036a2a2a1828e239a3fb

SHA512
86f56e5ebd306de7aa3b60b503ae31d78b52313af558460cf6469e5d284703f467bbf3145ee2623fbf85787a47b68a2fb31a9f9bac383eba14ceb8d05b776f21

Download Submit