bddc2eba81293075046a0b55b9ce8dc16d0a7ad03d9e819b0915f93737ad45c8

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_496a2c2ef8790d86111cd1ce7dde7603.html
Size

71KB
MD5

496a2c2ef8790d86111cd1ce7dde7603
SHA1

c76a7d7ea9ae391070088ff22be4002705c8c288
SHA256

bddc2eba81293075046a0b55b9ce8dc16d0a7ad03d9e819b0915f93737ad45c8
SHA512

e39d73e02bcf33c6c956d39bea07b35cbabbea6ff4b4ac0b94b0d8d11d651e8669d045ed3df3b350afe25327ff1bad349106c317a8528490bbd6997853f7f5d1
SSDEEP

1536:vv8Jl5LVodXhcIGodXhWxa3zR7DmOTgbAl0Nkkno1YptDD:wxVodXh/GodXh1VGqSsYptDD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
5736	msedge.exe
5736	msedge.exe
2744	identity_helper.exe
2744	identity_helper.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5736 wrote to memory of 2724	5736	msedge.exe	85
PID 5736 wrote to memory of 2724	5736	msedge.exe	85
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 5876	5736	msedge.exe	86
PID 5736 wrote to memory of 3444	5736	msedge.exe	87
PID 5736 wrote to memory of 3444	5736	msedge.exe	87
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88
PID 5736 wrote to memory of 2000	5736	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_496a2c2ef8790d86111cd1ce7dde7603.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc7946f8,0x7ff9cc794708,0x7ff9cc794718
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16231782842318261755,7276249462863925156,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d6b4373e059c5b1fc25b68e6d990827

SHA1
b924e33d05263bffdff75d218043eed370108161

SHA256
fafcaeb410690fcf64fd35de54150c2f9f45b96de55812309c762e0a336b4aa2

SHA512
9bffd6911c9071dd70bc4366655f2370e754274f11c2e92a9ac2f760f316174a0af4e01ddb6f071816fdcad4bb00ff49915fb18fde7ee2dabb953a29e87d29e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a4852fc46a00b2fbd09817fcd179715d

SHA1
b5233a493ea793f7e810e578fe415a96e8298a3c

SHA256
6cbb88dea372a5b15d661e78a983b0c46f7ae4d72416978814a17aa65a73079f

SHA512
38972cf90f5ca9286761280fcf8aa375f316eb59733466375f8ba055ce84b6c54e2297bad9a4212374c860898517e5a0c69343190fc4753aafc904557c1ea6dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8ac6ab49-cd02-4931-9bf8-a216cb31b1fe.tmp

Filesize
6KB

MD5
2a689c9815881d36a2cabc91f1ef47ce

SHA1
646cebfdd5f371045ee4f013b5cb2372f427060c

SHA256
9d2f61ba977b5d97b4f4d256785b73d98658391801c9c532d83fe372e06f6560

SHA512
04e89240a0ac148e66f4fdc8af78073a1e9c1cd3cbfbab6697adf1197b20bf99defebb3a873339cb959c46a54d55bbce10262a9395a2ee789bb89fe67f3ae774

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
20KB

MD5
162b642946a24839c05530fb1e6059c9

SHA1
077376b7a9f0305600a193d03f7efabbc2aaaed8

SHA256
03c8a9d542b931ca3b2d6a9236ab3af3f4897171727eea729d75b1bfcbd472f2

SHA512
fc77d2d1e7797f7586dce55e85046bd490c8821b8edef88a014ea5e7c5da22c258a9133e4fc303e134c2778e4005433f876e667c93187d399dcc1443695c3ac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c3137a6455a4738475ec4b2def8308c1

SHA1
5990c6a471e094a94c327d2c205b899377b56c82

SHA256
b2c8d538d5f1aa8fc2a6246aee3916e0e2d3ac4f5e1363e417414fc52825c002

SHA512
eedfb884d2e3cd3e3e49d443a36d031002a153b633e44efbe6afdf775ad17bb034a776087cb4dbbca9f8de1601352501c979ae650744fb17999032b3a085b798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c6b34071337ea03159bb9dfc2b5750de

SHA1
6426100a4884633e8cd7c33b0c458b1072745556

SHA256
87755ac4cdd3a94c340a4b4cab1482ae1efea9263476ccd95a11d699631cadfb

SHA512
ab2342a4384f38f81e725337230e2a4f04ee360389e1f3c070bdf92a9e8cd57881692f5ce931c08395c6278e7c00b4dbe67364a8d549f31376ba4742a521bd9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ad98135bf45946f5d8611b06ae211a2a

SHA1
a359052c39cdff61a1d35a28511006b861205e3f

SHA256
0d4d940fc341ab17618e5912aa5b9e6eac01fc1375b1a855f82b1e60e94559d6

SHA512
1f9d4cf87b6c06ffa8d404d12189d351a249ca18fb6d889c42b90bddb0f0c1ebc8aa513c0f75a57c5064b7a8cf07e8281dbd43fd221b5033c4957d17495d45e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ade150aa8b9625c424d3390055e073b5

SHA1
2169f3970cf401cce518847eaf230fbab27e649e

SHA256
7d388b5095517d29531dd1b023655992c518230cf926d8c323d33e20bf3101f8

SHA512
b92440181e71a575e3098ba928cdc6dabb57a6786aa872110fbad3c2eb27a076798c4b8754296ccc69078eabb46cabec20ed5ca1ecea9a0ec31465e35049c7ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
949fd90f1120931089d6825e7b3824a7

SHA1
5fd5fe23eacf4b2c2402e3f9a05d19901aed04e0

SHA256
e96f194ffd16b341d5d6d55c86a2b789bb94124112818d710e17c2a71bc63b11

SHA512
1ff34b327d1b9d8e59285793f714a9c488ad4075aa7a1375c7b6da799c301f18f5a5f6069ba4e8e0c2877a165adbed9f39d6b3184281a139c47607abdd078c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a7691fbc675d187af3bd524986302d41

SHA1
2c015b4d46acb7a8b8d4b6e3daf2d5e89af141b8

SHA256
adb770a8faac52dbffeb3495966f0212945f2ff38dd35e9334def822ac363a6e

SHA512
abc62ff57f58cffba3dcb56e90560624a93a62f6c0ebdf08b6fc1cae357dd9e4feae74f1f58bb92001ae3fca2cd7cdbf426f3bc8e12cdd2c4f7a93e371b50622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
22180ef27257a0d2bef9fdb0e42115a9

SHA1
dc143c9c4930025aa4fa32bdf147ff092afc5d35

SHA256
da834286770cda28f9f17b907ddd77c978b42805c0a09a7b5abb8d54c53520f7

SHA512
34ba63fe4ee9a19f0efb405e5722df9073c766ef33a271b7f1d2a4b15d43913302c8bcb9cacb5623a991badbafb85ea247275b3a68f5be556328b0d0f0135951

Download Submit