78836ce7a61253efc1c99f4dba25cca7061ebcb5695342fe871c267e1c6be8c0

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6782a3c39ef056ab1082260af6bd89f0.html
Size

66KB
MD5

6782a3c39ef056ab1082260af6bd89f0
SHA1

dfc83d7232b2c98e67b1d364f8e09787f4167266
SHA256

78836ce7a61253efc1c99f4dba25cca7061ebcb5695342fe871c267e1c6be8c0
SHA512

65aa348eeb92af2d5bef0a01a3d4aec8ccd64677d0efbd9ec40e7e9a80292612187119791eb518672ca02f9a575b63cab34dc8a8b4fe1805c9625c6412670e3d
SSDEEP

1536:nwzAbky54I3bWYZ6uLbcfXCUkTFGEiarVmS67QHwiAEFyEe1nsJSpFNql9wLv1Qk:wzAbkymIbvcfXCLkarV6UHwi9g1nsS5Z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
1248	msedge.exe
1248	msedge.exe
4000	identity_helper.exe
4000	identity_helper.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2128	1248	msedge.exe	87
PID 1248 wrote to memory of 2128	1248	msedge.exe	87
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 1344	1248	msedge.exe	88
PID 1248 wrote to memory of 3348	1248	msedge.exe	89
PID 1248 wrote to memory of 3348	1248	msedge.exe	89
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90
PID 1248 wrote to memory of 3040	1248	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6782a3c39ef056ab1082260af6bd89f0.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0xe4,0x7fff3e6c46f8,0x7fff3e6c4708,0x7fff3e6c4718
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,8713526248597975553,3002335153783288459,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
14f0f5365d298c4c594511d4b640d918

SHA1
dad4fce934487e4c8b165091612810cb6c506864

SHA256
6daeea78cfe22986edcfd55f7a4ba48b4b6caf3d4bb0de97c72a85d1288fdf20

SHA512
a9dbbf2e2d383ae5eb6d9a3fe9557018a9e3783b685c57bcbfb99300b3213bbe766e1a17a43c55022debca66e94d8a36e9c0871f80f5ac3dbef58bca3acfc1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bdaedf93fae9e360102755d7afa6a1ac

SHA1
6610c7468628638312b517b2c742a554f99e33c1

SHA256
d2e4474dadaaec1340b726f419b5c6c7805f4b5ae1c4696883154b15ea61cae7

SHA512
46dc085db56b18d7c9d2fc063209fa21e4abfc075f2b5fa372e552f6b1934b832313181aa8f82023afe4f44efe2bca6f88e542105a554d8e2e21557c9f3b4ffb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
20KB

MD5
162b642946a24839c05530fb1e6059c9

SHA1
077376b7a9f0305600a193d03f7efabbc2aaaed8

SHA256
03c8a9d542b931ca3b2d6a9236ab3af3f4897171727eea729d75b1bfcbd472f2

SHA512
fc77d2d1e7797f7586dce55e85046bd490c8821b8edef88a014ea5e7c5da22c258a9133e4fc303e134c2778e4005433f876e667c93187d399dcc1443695c3ac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
432d434f34fb376e1c21bbb9b3a87123

SHA1
0c2a0d6b05f640ab85d782ed9bfd9710e39b9de1

SHA256
1b2f88cf55699f7dc1671552e83d4129cbdbd6974a8c952f05ef429270a21188

SHA512
9c92e5ba80a562e959fc43990321454813e5a24a27ddf4d735b8c34915a523b5a254a0e22d7942734179c733addc035406cb0671c4c1079fe9d408bd114a8ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5b6204a18dabd6be41fbea8ea41c7110

SHA1
3cacb6180ba0e34e40324aa642f57209ceea0e0b

SHA256
584d324582da820a7e8ce3847a510dff0710498b7f5124a7cb756d1003f03fb7

SHA512
e3de36e63b4dad395b5625cf3ba5f731cfca5c3bcad9af6ef4583e1b258dc3875773fb876fbaa60a4dd740e587f8a60aebebfd78228e3c283bc259a22967d23f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
92295e58bafddab6b2df997c6fc91a38

SHA1
753bf9585a87f9434ed30a5cf0c115bfd4df54df

SHA256
410ad4a46dcc25c5761ecfab06a31d8d686a22a4fcdd9babae88bf3fc4a4c023

SHA512
558371134436a211622effe07895cb8d3b6821ca047b5a21aeed0cee9d2309fe176008c2b1540ff852f17a7b525c560734037a730b4aa27e50c6215dea9c2b10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
322d4f2fb31cbcde02f8e008ef4cd628

SHA1
bcb4ab16c641dc626c4e88fa1ee214b6151b778e

SHA256
e458d5f88d5415e9ff2d7542ad8abf3178b028271ba4583058a2d900b6864e1a

SHA512
eb8001b1431d1025342efad81ae73a53f3befc7a2fd9d5f65b76a57d548df8e211a107322e8c9697f715ce7454147702b0ab18ac6b8350f3d9a0c3b64c6e63b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc699261551b89f97b6f3a8bf841ac2f

SHA1
d8e26696c1a4b932d6d7a89bb66f8547dd45822d

SHA256
582e380f16891b3907b822d46e7682c6912c200a01edfcab0a155b8a0bc4e242

SHA512
c274157570e29fb2029b18062105be233e887ded69fb0c632ce7c199b472ebc2b9b2011cdb30e4546ab8c63c73030adcd34cd2b5604401b8e3dbfa0bd0156f4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72fb1d5d99fbd256dd7c749998bddb07

SHA1
9c6ec7bc9e416ba27e72a5e4792dc371c12a11d1

SHA256
d26bc6340faa23dd9d5598d79f24c8068df5799d2bb53c333c9a3b298ca789c2

SHA512
3621c2c03b5aab8552f2a85e12d9455c0319006b43febe344ea68d28eb9f9fc9272756c032c2d7a1c04743333a28c14c0fd845ca8016b5735258d03a866ec9e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1b36f7ff91b97cfa7dd70c513afa118

SHA1
a64a351e5505ae4f57b7ad249e770e13ec80474d

SHA256
385725bd67c30f4072478a548f77f62a4189692205e57bc3b49f7e0367dca063

SHA512
2fdd84e78222e260f1766747a806c779666c2e4f4c39b6ea956b20708d3909b5ed8a4fa7cd55f590678aaad846e861a1c20723c5c96ff5b7bcc39e13260cfc24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
969c456725598413f3fd3665fee1c6cb

SHA1
9805d0ccf22eeac0dc64d43adc30463ae142b7ec

SHA256
2e66dde465ab862a9d199d262225a596d540c7aeac69c0a213f3fbb6d18263cf

SHA512
72dd3e7dbcbc630629a25fe8b91ed863ca314fb5b7255d5a7ea8a96747a4622a46d21d3c0efd3b70dc1057600c6c6d568b2695bd9df79775b11d9ea4fb7545db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a5f4c940205a5606ad2f58c5ce111028

SHA1
b892d797d51adf83fe061a18345c6aff1c90e140

SHA256
d683c543b3b96ad7eab5e96bc054b034aa754aee5043dcc3fac2b4463bbe6164

SHA512
64f91410e82bbbab8c8e3b16474ab7ec28dbbef28181b937110bdb99de09d1f5e8d4e3e8263b5e942852a004af68bcbba654c2748222e10578932e18d7ac9c8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
03fec4793d15fd7cca821251e652ff66

SHA1
c7247589c6aeede6f5deae1ef007068488f4c221

SHA256
a8a3908068ed9f2ef2a5781bb8d4fd39b6e6a21d8a6e103064d21620f959afbb

SHA512
6cd7e5c6bf4026b75bd4aa668712ac00ed52e211e1ee4b4f1c35cd5b6afe0d4ca58d78c82d52cce0c11c3f006f26ec6bc573cf10ec59c953d9e51d7100e3ad22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
2398fbd55b3a47d4b535d8391138e56f

SHA1
67aba00398f7cd7e2cc4779a3b4ddae5ab488473

SHA256
8d56506734da643692e7e8b653a9d93384f4e0f124fe11b5ca2540252da05f5c

SHA512
c21f8ac62bc8ed7dc9424b0b518e4d66445ff5f0d95b27f6e7cea820717444a04ee092867664a4183f2c9c604964031cebdf02ad773a45ee3fb5a1c97161ce71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b06f.TMP

Filesize
203B

MD5
7369857aae987837c8fec4b456551ca1

SHA1
2cc670b11f84466f39855d6e341bcc9815173a5f

SHA256
368e8f25492f0dc6e075bbf064e15e83652a849ea5e7651339411c53425907a9

SHA512
723d0f938104ead1e8ba317200c25e448a01bc4f592c81b5facb39c83dd43a6d10dee55c04eb310c080c18c4d631ab9dc359080789f4ece6efe75c357bb7813e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
d42a156750c22ee110a3918c7255198a

SHA1
fad09fb579f47258ca663a957156e58324f0b907

SHA256
6ce3d6b2967fa4083651501de20e265a7146b43bad944ac0a0a41f16f9c7657a

SHA512
7a7db67cc611b47839de0f5c9010db9b3644d8515e2a36301fe73f6eca4e09a23c5936f5737b01a470ec94701af9a8c4cb87965df57dead2b83db4e288367e38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
201cbfcce43c8d4e48f32f0562b145a0

SHA1
609754469e16d67ee6bc77fcab193c9a252c56c0

SHA256
75aece87017c23e37483a93d18f8fffbb62dd78775728e3508800fa5f9a82dff

SHA512
3bf624473ec73e6b0b383401d5fbb63ebd5bedd23a58e7aa3d0ef6244f9801cec1a7f4bdcffecb98a79807e80e053e4ee16fbce541de0043ca3dfff50a8dba9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
5KB

MD5
cd57ff1352f1d2520b72f886e36a8ba6

SHA1
d01a75efcea80d83176a6ce01bffaf52ef964713

SHA256
325757ca8e15269038f86411cb667cd98a14d11ccd971de0e4f6d5ca496749ec

SHA512
836d990820539620d13d7d7e09ab5209e9ee1a8eacf1be534edf2cc4f20803cdc4bc614d13df914bcaad102bdb7b8e407dc4389852c80ca3637acabbc5e7a8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
7b75315a6891f6f89c6b7d2262ba3027

SHA1
1383d0005ff460fb88fee5ddfb264b4d4c5cb542

SHA256
9d83d073b22b961923a4a111b72d87c315029dbc306b523da47cf4219b181e35

SHA512
2101706f1ff948bdbf70940e46b5196e871bebdfca8d951c7755e55bfd18a1229fbe19d0a2a5eea3373ff71b42696b71234df75f8c2993bd8a75c52353c949db

Download Submit