214370a503377f646c8590ea5ea6d062a22ab1db67822d5bb63e6d27b9040ce9

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_80a7fe9e7bd28bfe6f113e8bb8b3f465.html
Size

124KB
MD5

80a7fe9e7bd28bfe6f113e8bb8b3f465
SHA1

6a89e3e53ec6787c93acb54ba6a58c41ff1a264b
SHA256

214370a503377f646c8590ea5ea6d062a22ab1db67822d5bb63e6d27b9040ce9
SHA512

36903b4dd2c0f660b4fe1b61b70b1bd31a734a096729d58c7b774c5ac27cd50e48e41dd57a45ace124667c1ad717192f5878785c14ef55cdcbe0de6fb487fda4
SSDEEP

3072:pUfCWDxYxQ2PDxYxC2T/Z1sloEZNXSSefhENE/jzCqezNH3GO:pUf1DxYxQ2PDxYxC2T/ZJA

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
1860	msedge.exe
1860	msedge.exe
456	identity_helper.exe
456	identity_helper.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1212	1860	msedge.exe	83
PID 1860 wrote to memory of 1212	1860	msedge.exe	83
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 4760	1860	msedge.exe	84
PID 1860 wrote to memory of 3580	1860	msedge.exe	85
PID 1860 wrote to memory of 3580	1860	msedge.exe	85
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86
PID 1860 wrote to memory of 2156	1860	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_80a7fe9e7bd28bfe6f113e8bb8b3f465.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc44f46f8,0x7ffbc44f4708,0x7ffbc44f4718
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=13464 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=13464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13260 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,17150673420048998668,2735828129784878845,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5544 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
01d27c5053c4b4cfa78713fa955b81db

SHA1
ed39d687ae76c0c70daecdc7006434a5eaa85d6a

SHA256
5e8c46722e0445f323fe009ed634ef7733b0e8fa1bedd173f97c6fa140d1e7dc

SHA512
49eeba1097f55d2a1f22a169becb414999b2878138dfbb1e3fa1dda7405fb6ff8959bee6ef17455806325ad28ac6702cb237141b1975808bc5412667b1abbb0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
928c82e0219a98cf8f30dc38e20c7612

SHA1
31e93671ff3775e1ad73fbb78d3d7a1b4aa0e6b7

SHA256
112eb45eb6c4618b433f15ec007a09eb5b263ea14ac203bf1cd1ae67a86e2daa

SHA512
4517ae88af0f52b586a3ae6d5f55c3af796764b4cbcebc0f19afbcc6c602488c98e1f49495cc98fd4a82c0dd2b40f8c1434080f4aac3d70a7dfc4949e2a499b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0d1ec70ae97aa932908446fb99b152b0

SHA1
e6179e28938a7304671d335e852dd4fa4677e33d

SHA256
1b7d42b3bcefc7b7da1cf22f10126e9173ac5ad4fa154c54e90eb07ee8c72e56

SHA512
ed3d095a52670587bc50fd81e7f3c5bc3eee2f5bb3c2d316485f55d8599fdc454cfcc719d022b1cdaf34a7b952f1a1b228edfdc108243a3e5a39d004b37720eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dbd923ab1ddcbedbde22a23663780a08

SHA1
436a07cd923d9d8a653d42b738c57578260b1abc

SHA256
275a1d34eb8f163a10cb88e18487ca38154f34142758a7fb7d033b402002d0d5

SHA512
b7543e8790adef8b60bfecb4f730b249d921f98927f9490022d0052542e9d2acc07a1b2add717494c7f4673a5159997618c25041fa9813c50a6ad8d36c7d9808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7eb1d01020be09626e5e8ac06992264a

SHA1
6f3a99f9bd8d880dc4963e45bfb09a499f498388

SHA256
daec228bd04e5350c9c6f8d696a7052b93e2fcd4715ce966c2f903755513e96f

SHA512
46a30baf54ac014b382a16d04cc365f553a01beb324dd50273bf1fefb264e8594fd3688756caf1cbc024057ed411da76333ef3fc21178a288d98b64513b5ce58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
fd844c2c633b08f93c0e57421f324b0d

SHA1
749427087bd749251b3c77496cede7de11f1b411

SHA256
bc13e65c678f40962b85cd137dab1bb0ec9398f7a902d0cdddc78f4404c1c123

SHA512
3409d17985069cf4b86e9d89fee07a20dc1769a8b77d4719788fe6d3357891acb43a91e0a0b5996ee15aaa45aefbd3e490950c19226050b742cfd61799487fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588f4b.TMP

Filesize
203B

MD5
d43148f5a9d8410c889cd328a2ca0343

SHA1
3f209ae59ef5c0bdb4418d70ffd3f1fdbfb48e11

SHA256
8a5a45b148666a8a57e17d89a2d9350fd172c89d37cc83835bc6a69fe12c467b

SHA512
c407ba35d5962bb3f98b2ad6f0bd3065b8474ba93593b2b418fb78f397d365eef721f94fd4c3de7e5be60abb7d9e1fc0bd975b98bc1881dbcfb8cd3eea805bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e1ff6554d30d6d9552f9dfc35ce6808e

SHA1
07ee854cf38a8adaa319b2573b86c5f7c421a5c0

SHA256
fce9164b298a1f1871796d9301e28a785deb8686724adb3a58ae9e10e555e17e

SHA512
e835f8bd08b0f7d47f15d5096c21adadb50e8df21c4809b8fd3c6943d8afb5f1c13e59d6b1fccabe055b1f612a6180d4fa745728a096ec9166d2053b4510a258

Download Submit