14383d0bfce6dfcba4b767c462da61848bf2e3849d2814fdaa68d9821facbcda

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d9a8d42dbec08b126dc9dfea4539bcf4.html
Size

76KB
MD5

d9a8d42dbec08b126dc9dfea4539bcf4
SHA1

081a404ef14da88e91e7652f1e274ea9324968e7
SHA256

14383d0bfce6dfcba4b767c462da61848bf2e3849d2814fdaa68d9821facbcda
SHA512

87eb3ec8725d4e03ab507e9fa45e787bc79ceba811b728cc62a7cbf28fddf5402ad591c7abbee40372ac21aea2d1915ed46bcf9bdcda7a61dcc721c45ce93381
SSDEEP

1536:dLNCGEx04G+E63rq+V4VTrFO6X69JCYSBKS53kwKTlqAbHrJM:dLNWK83rq+V4VTrF1XCmv3kwIbHrJM

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3944	msedge.exe
3944	msedge.exe
3512	identity_helper.exe
3512	identity_helper.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe
2616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 1796	3944	msedge.exe	83
PID 3944 wrote to memory of 1796	3944	msedge.exe	83
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 432	3944	msedge.exe	84
PID 3944 wrote to memory of 3840	3944	msedge.exe	85
PID 3944 wrote to memory of 3840	3944	msedge.exe	85
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86
PID 3944 wrote to memory of 3476	3944	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d9a8d42dbec08b126dc9dfea4539bcf4.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe72d046f8,0x7ffe72d04708,0x7ffe72d04718
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,10021904541263937766,10815351043775365489,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
c75f322026c1198614b97576d11a6c07

SHA1
93ce14c98f0fe891104ea4779e8b91bcbb7a9d0d

SHA256
62b607d3fa96f7ff1b967bb2f8c247c3861933fdd2dfafeb7c2f22f86cd08b92

SHA512
6326d9aec9f8efcd2ea4a00038820a1b2ceaa6177d47743a23836d0b764d677bdd9b0d9369ed51346fe8143fa863078d8e715edf4021b136073f59748a0f6288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
1301c082d92d3d6c27682840288398d4

SHA1
3757bc69166d78d7e986e153e89bcff33e9d1b78

SHA256
caab9d1525c158505720124c67b5510685af471517ab1f731adf39fba1acabaf

SHA512
421c93d891cf2b12de3ac94e3743a7a5684a6dd71ac4ea0f256dd4238b1af8a2352bdbc87450c4aff26701e47dea66bf9c34bbeb4c010b06ad196ac2c9a2a2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
af5c96699366812a03f90d74bdcfe7f4

SHA1
0e8d0f26f85234fbe2851ff93ad7eccfa9d1ec1a

SHA256
911f42f521fe61d7f4c14d524273f2dda99bcfc1988197bdc803a78c5ec2075e

SHA512
7a3895221d9409168b4643c93d8279dc6c1cb39213e161b366d0495a880831b1638eed8bb5773792d68ebcd208092bc44e366bc6b8e252cf1906de3f393ccbe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
379d2bf7ae21d1bcd058689bd9df5b2a

SHA1
98a1287308facc60b66535c7085575a7edbef1bc

SHA256
2c82fbdd6722d8f22f2b18f8a608f8fab982cf0ff2271ee61b587ce028faf4d1

SHA512
7d60170c0f39c6ae64f6b7fdd7d76a220631c2304cf6ccedcdb8bc9655afee8acd6dc7c66cf9e115acf01a7f5b400d0c73bfbae392e5e5cc2e294637335712d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
31715a8c100658b335379d9d83767adc

SHA1
e715b2abc9e5b4319c2bdf0f25080781dc97fa84

SHA256
78fe89c4010d3c5b23dff9da83bbdf0b486ab68e6802f73b5add4b662b9e5a6e

SHA512
40fc41686d94399138a453fdfec4ec9da0710ebdfc22a16d1489595d6182c4ad7292ac48df0ab2cabc9e69afa6e54c97a203298b32cb2488b0eff54bca964c7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1c302acb733cefd94652dbcbf4def14a

SHA1
40f2a0f8399692a931fa825d56a4f86dc52eb14b

SHA256
40cad43123487237d2500364c12a8a364cdbdd55f3ea020845ff5139115397e4

SHA512
ed14a5369a48078adb15fddb7cb1177812ac9d10c57d91d4ab5580a5d4ac87b648a50d8428ab2fb3919244f5f63e5b9b9905279cfbe4122c595cdd2f1ca49100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ec2054b5e0fc25b0ea0bad3cc049f562

SHA1
daeef6ed1bcb941f523b6fe42cc9a5060e43f1ba

SHA256
16238559be340546117754f943d17959de5b26eccc1f5791399d4daaa38d5177

SHA512
982ce60404d7aad16813fd45c489a159fe0ce504c4b1dc9084ea5e7667e392b00bd54b32cbd2fc31e926a688ff7e112e9b6ec4bdc710b4ba0b1d0465ea8f32dd

Download Submit