92409c9a58732d7fa357953c19f61a567201f1af178a7cbaa759769a8036a568

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4211920096f2ea66e7dd71b8aae20152.html
Size

73KB
MD5

4211920096f2ea66e7dd71b8aae20152
SHA1

73c45bd59339b08ffc26b4839e2a4593ebc32ac9
SHA256

92409c9a58732d7fa357953c19f61a567201f1af178a7cbaa759769a8036a568
SHA512

e555dc8f1c13d3c6f72b5d3f1469b59a5f00a74b9b5dec6b535d494681eb40c45ed33faa694048b2c0779561052b280a974dbd9e4fd6bb7dc987aa4f5ca3cbdd
SSDEEP

1536:6Y7Tk1ukrfImnSgpBokOGAKKeUI/pVRclYFMCFY0ZRAbnza8FwtkMg:R7TFkzImVpBuyFMCFY0ZRAbpFwtkMg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
4208	msedge.exe
4208	msedge.exe
4836	identity_helper.exe
4836	identity_helper.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 5072	4208	msedge.exe	84
PID 4208 wrote to memory of 5072	4208	msedge.exe	84
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1044	4208	msedge.exe	85
PID 4208 wrote to memory of 1836	4208	msedge.exe	86
PID 4208 wrote to memory of 1836	4208	msedge.exe	86
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87
PID 4208 wrote to memory of 4748	4208	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4211920096f2ea66e7dd71b8aae20152.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff965cb46f8,0x7ff965cb4708,0x7ff965cb4718
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,9751139043357788721,10403371004382397342,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6738f4e2490ee5070d850bf03bf3efa5

SHA1
fbc49d2dd145369e8861532e6ebf0bd56a0fe67c

SHA256
ca80bbae3c392e46d730a53d0ee4cfecbbe45c264ad3b3c7ee287252c21eaeab

SHA512
2939edf5e6c34c9ea669a129a4a5a410fbbd29cd504dc8e007e9b3b3c7fbb9bea8c14d6177ac375d0c481995774a02d210328569231cb01db07b59452333b22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
93be3a1bf9c257eaf83babf49b0b5e01

SHA1
d55c01e95c2e6a87a5ece8cc1d466cc98a520e2a

SHA256
8786fd66f4602e6ed3fa5248bd597b3f362ffa458f85207eaa154beb55522348

SHA512
885b09dd3072921f375eedb5f0575561adc89700ecfbe999bc3e5ea1d7cb45e19d85c5e420f2c0a12b428742e1110e66f4ceecbe5a6badddd36cc9e0aff48e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
3c099fbc8b3cabec440c9a796c98213d

SHA1
3bb5f2db39cc5a35bb2e75802d69487be56b7a26

SHA256
15a0ab881d17ad8d346fd3cceb6e2ec80ef96fe95902852f1299c1b5feee89ac

SHA512
666d9e1d208caa07b824ea17a0889fd08858eafcb157a72c87e9706a008b56f67cc6e0c68accc821859c36653efd511b35f5c6a9fc5943647b87ff40ff824661

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
51c2cf9ac028c11a3516f8f18849b994

SHA1
fe7ac079f2730a90acc7dfed563f111e297af128

SHA256
29b28aae688cf919800e61abf27857a3affe8a9bf16801dc66b4ca60b4863cfd

SHA512
00065a4c16f042caf6acea7b79a001e8be29bc9fd25911e8416227eeb1bbb03f1c83daf4843bf71a5b7615a54dc2f6a58d108723838ecd07abdb3f2950af2442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
290dfc285ecb5fa6869fcfa4adb9ab08

SHA1
7d0026d372c6707488fa3cfa262b3708cc9ba88e

SHA256
46fa49beb9171234173bfa045231fbdf059356b132106690fbc12b8738707550

SHA512
5e036afa57022329bf05b9c75c3704c641f5063d2d816c66aea7089bb50d6b4e2293c6216b1cf63dd433363d5d51d9077cb86eefd541755a71459a585957f654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7e669148ccc82606ca4ae80277443777

SHA1
0cf9e6b85a80f3ed922f42d7316538fc4c0e5ed9

SHA256
5a1283d3429fe2b209ecf2a4ac089225b1fd755f68e0f87cdf3b3e1edc2ca201

SHA512
07739266bfb29d729e2b96444647b4316c2070da494fce6a227cee97559c713276b6819ed482acd0983a8e0f67fb8a05993b762fe7d22f77453690aa96a7bd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dbbe1f4ab3abdd8ccecf98cebd87ef64

SHA1
4c3901764871fed08c4eb830297015a7bc39df42

SHA256
52de9a5b630e29d6cb487abb401c21db3d0f4be387ef0206d7f5fe085f469d3b

SHA512
93a1272f0a21984b233d0c927c570c0b26cdcc515a4365a6265c4f1451592a3763df9b256e5273f7a99ae16946dfeb944c8323c0481c6c759e19b2b7987d8f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eaf79723e9c69aea3a592677b3ad1e67

SHA1
43a70401e5aeef9a2020a73eb9af1b10c6b06339

SHA256
c0d56b6a8af7b7c192f1f7ba8288d7d9aa12c5ad1c274f6f8a52ac0bc5b7c6f1

SHA512
a10fdf72b27d42f1326d62f6876dad324dc30fb9e31ac45e6052b60328b836231ad69248a3920ee336e7a34d3ace16cd4d86b765eb0006e727a35400695e082b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
88cc72ac4ad73c65535874e07994c2b8

SHA1
c9783b96ab9d9a3ff6f6f6d58aaca6cede00b33a

SHA256
98dcbfe255da2a8284d536ff8b2ee04a56e3d693ba3a0637b640109f754e963e

SHA512
9a0ff82c6f5ffb296f375f1977979c33b036f3d6969922ae644e07f84f688f556fe9557b05f321f46958ab621dba3ccf3a9ebdb92a59dd46527b05f0c110f487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
c8d0daf014093997517efe551642ee5f

SHA1
8c3e4e3afd059e0a0e9d33e03d6d6cf24dd6a7a2

SHA256
620b7c51f1e04aeb63d0148d54170ef2b47ef24a6b3e27a2212f48009f7e1d18

SHA512
97e1dcb78c53e6db1a01800e9f6962f6e2495b4ce4c05584b35bb99188d5b257d3c7e5de7f50f3d6a64568eb96e334209206241ccd9ec6cf5583112f3bc849e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581652.TMP

Filesize
203B

MD5
968ea374b3d9afe4fa569de77d8c5478

SHA1
d86178122325c1c4ecde876266e6314709955fee

SHA256
bdec77e37ef39a709da9db7950d27fbc2347b3fcbeb87f347118ee9c022185ec

SHA512
9a378eae5a99dda569724058706b4b2bac721bbcdf2b8523b257ca47d85b88ef68dec85d59dcc2f7c04a24d3bab3f8fd6fbba4de608a9180bfb03aa5ea15ad3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d87c24a2c8f4cc1ec6e4f23e2d2ba2a

SHA1
c232feaa06bb7da4672a7660bf4b5e95b155109f

SHA256
8fee55d70d70c480c7ebd6cf90ec40d742c71c969ed5d52e5494acda0285a202

SHA512
060b2eb491e63c22f7c14d5ad1284f2f642dc40c0f50d16b601df86ad09cb1ac781837c82eec5ef5a99644f9ab6d3a36f3ff6dbfc4fa461c5c865a792908ad01

Download Submit