93f70bc7c10d9ecc0a6506389fdf65f1fe87a0871fd4766d05d3d7f9b3c3f4b7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_dea659ba30a88d3f1d3bca6a9ff8f9e9.html
Size

53KB
MD5

dea659ba30a88d3f1d3bca6a9ff8f9e9
SHA1

bd1ca9a1aa2cbad5f2902be12806dfbd5ecc341c
SHA256

93f70bc7c10d9ecc0a6506389fdf65f1fe87a0871fd4766d05d3d7f9b3c3f4b7
SHA512

03f4fbfed9a3a4bb328e3b7ed696e48a22d53f77d6dd0213e4605524cf6edd3866e739bf28ce600690ca2ed62df0715aadc61254a0d47295f516734d9a85f6fb
SSDEEP

1536:/BnrXKs4KpB3fBSFC6pXMI6N6f6Cr6060XIn5R6N6uX4m/626MNIM/tVZUjBzzQO:5nB4KpB3fo3fIM/9UjBX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2680	msedge.exe
2680	msedge.exe
3464	identity_helper.exe
3464	identity_helper.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 4488	2680	msedge.exe	82
PID 2680 wrote to memory of 4488	2680	msedge.exe	82
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2640	2680	msedge.exe	83
PID 2680 wrote to memory of 2736	2680	msedge.exe	84
PID 2680 wrote to memory of 2736	2680	msedge.exe	84
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85
PID 2680 wrote to memory of 4800	2680	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dea659ba30a88d3f1d3bca6a9ff8f9e9.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0c6c46f8,0x7ffd0c6c4708,0x7ffd0c6c4718
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14532076481130980135,15720287213897007906,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
12677a0e808933295d8f80a6c577deeb

SHA1
d3c622136a835049f6aded6bd8355721f34da972

SHA256
bcdf28dad63537eb1aa415832e05c275774d80bb8a138aa2b370577e79385778

SHA512
329a790fa26cf8588644b374392eabed1f34e2413adc1eb7d37c372643146efa4f44767a5875f173f7675350bc797d5a47d6078bc2a58a92b67913613ff5cd63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ec40b01c8bdbd53c0546a8bb55bf2e86

SHA1
9a22056bcec018b92e0a1f72724695ce9d05ce5e

SHA256
b92303dc9f92679172181fe894ba9d5709ad0b797befe259386e61db5a2cfc15

SHA512
1e0724892c0249e1ffa6b62790ab5390d848aea435495eb2cfb395c6b0bf13c5d67445b4090d79dfd8bdc6160c7c4cde927ee2446d080f2ca31096cba64d23aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
95ba5dad459515e28f951cd52840ece1

SHA1
2460a3532afb6cec7edda92afa67910ea70ecada

SHA256
d07acad6a18ec08839ed93129de9d1fd8c54b7816745d824d1690a8810c28b0d

SHA512
e4cf2de6528f1490a1f2a05a2c7c4fa8061bce4c2f512ce36e592dd4fa4b2dea59c3bb1e8df074d2bc75501ffd587cf45f5284a96b3c024ff653c9bb0b8d8072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
364f734b72cec2fbb5d327319f75d44b

SHA1
b297cd220b68c088aa48a33a541dbed161c04448

SHA256
f00044dc7bc69dc2f92b7cb88971e77643dbe4c58bdd8630467552e1aed4c4f2

SHA512
d3bde65ca491f3027fbfc91ba483130f10f12727285235842a4700730ccba3596e15b5fb55d68180d82c1a50211ac258ce99389720b62272b451be5f15776768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e55ed5f3f94e846209c483cdea9186b1

SHA1
75aef3fb65653025d17cc2a7eb83f041327d543e

SHA256
0edd6c7cadf552504b44f85226df97417b069b36deea1faac5e096706b6530a6

SHA512
8e8f3663d58ef8a6573d3a10d85995113d9c0aa74170907f4d3ef92fa09c06cf9c49904681dc26b6994d10aa4f5139b82b00cbcedaaee9e847a35dc407758240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2393432aef92554ef187445989f0f80

SHA1
70bb003c594af53e75d3faf0dc286df4f5bea255

SHA256
f6c9275746a7b140b75862b154f1409dc2e990ca1d8bb5c49cb220e5683f7713

SHA512
5418683a6a0521a2536ed0a5735761ebd38954d5582f12df18cad353bfec6a126a18e345c334802ee5e586a8f120c84fcd5bc8dd8586c77b0ec4d8df270da5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f0186fe9-b1d5-41df-9157-17151acfd92b.tmp

Filesize
6KB

MD5
c5d1c4781bc2857cb2411acf09fef472

SHA1
8a3dfb922437466d4e4a1ba2dd517275ccd3634a

SHA256
7113a1463fc0889f61af367067c28c3b1822a70cd0b39e55d81e8adcf8f94ea7

SHA512
4165203554158e7c765249bf50ae51dfa0a07ddfbcc9f1ba2800205e2d0a5ac499eac8c1c40e3ae33699da963154d965fc711571d24833d3139d4004d72e2360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca6183c2766ae167f7a895d99c26b28f

SHA1
50fca3ecddd77a931ad525f14d73708c6edaad5d

SHA256
d02575092c724eeeba1228f0fecc13e6abbe8446f74bb9d702e1650b84523a3d

SHA512
96f31f43e51ecd458ad354fbb6f6cbd6b4c8df8d3203a11374236417ac66ff51da3d8ec52a6ae328463c31007458916ca3111e3439941751f93441553149a9df

Download Submit