631e2e32dfc2b2996de364f8fcec3c8f4905b2218efdb88dabd9933b1ad2afac

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2025, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6c40523a1abdd5e97b7040bdf715e091.html
Size

74KB
MD5

6c40523a1abdd5e97b7040bdf715e091
SHA1

8c5fd50977cfa51676cf314432e9a6fd15aee586
SHA256

631e2e32dfc2b2996de364f8fcec3c8f4905b2218efdb88dabd9933b1ad2afac
SHA512

a6ab32bd6f2427f4163741ca2ca74513ce9ef3e81b8b872bb3ae1af706b179dd9c4a9f0c8d52e184c1edffcd561c7657fee6ee9ebd9575833f8dd1608bcf871f
SSDEEP

1536:Pv8JlqLVodqh8IGodqhU7qTjogv206DJ7a7y60M7iTeXr0FtyHXWzMATZBs5LWBR:QKVodqhfGodqh0O+iY/iwvptFD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
3572	msedge.exe
3572	msedge.exe
5864	identity_helper.exe
5864	identity_helper.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 716	3572	msedge.exe	86
PID 3572 wrote to memory of 716	3572	msedge.exe	86
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 3092	3572	msedge.exe	87
PID 3572 wrote to memory of 4844	3572	msedge.exe	88
PID 3572 wrote to memory of 4844	3572	msedge.exe	88
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89
PID 3572 wrote to memory of 2280	3572	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c40523a1abdd5e97b7040bdf715e091.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc177446f8,0x7ffc17744708,0x7ffc17744718
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,7657096253383505507,5626674197574391680,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5da507c2059b715761792e7106405f0

SHA1
a277fd608467c5a666cf4a4a3e16823b93c6777f

SHA256
8c1d99de087ac5f2e7b2afce66eff36a646bef46800c0c1d7737d6f0df74b7e8

SHA512
01c92729dd8061aa122b116a674c73bb78016f66d2cb8f7fb64907352758a825e87a1e345334386440699d2a6d1e17baccb400c5aee151eb64e64019cbebb870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c6e13dc1762aa873320bed152204f3c

SHA1
38df427d38ca5ce6ce203490a9fb8461c7444e12

SHA256
5c441148843b7c8dbff4c4a72962a532aaf0bdd484d07a03dd9a32fd461b1371

SHA512
133054cb042e11013bfdad1bd11e3407d08cf26a66d0743bea9708d261aa904a1047bb0097b187ecf8436cb6cff3bec28c89e435862cad0e0fa264799556b70c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
162b642946a24839c05530fb1e6059c9

SHA1
077376b7a9f0305600a193d03f7efabbc2aaaed8

SHA256
03c8a9d542b931ca3b2d6a9236ab3af3f4897171727eea729d75b1bfcbd472f2

SHA512
fc77d2d1e7797f7586dce55e85046bd490c8821b8edef88a014ea5e7c5da22c258a9133e4fc303e134c2778e4005433f876e667c93187d399dcc1443695c3ac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
bbc43585c2e801954461179daec96330

SHA1
e40d788709d2118ed65093ee95477fbc8851d350

SHA256
88afbbfbd6230dc38375c5c250be35b6e4111cdbca91c3b574cd3dff62a741d9

SHA512
0c7623f757fbff83502af231153646992c4d1d925cf6decf336e43649dafa05d0acb9a10b5f68b48d3d494b489fadd496260affea9f06f59aa2e04f3e4dc11b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
41d9fef2e3e9d51623401a4a9cb68263

SHA1
b8157a3de0c6bd6f3d2cf067e301072057a75f6a

SHA256
280ba7d839a2f75897b226704bcd43825b660b4486fee57b43a4f2f0fb9167da

SHA512
d419f43f1b32621be075b12eac17779988c14ed0d38aa1db947c45d4e7c89601927537357132aff278d679ac04d8a2d9219ed0256a85afe55fc11510de135907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4538e69068071ddcf671a0ee7cf63236

SHA1
f6f1e9de8db11c7dcbc6094d42a03651407eb57e

SHA256
0db5acab58311e2fa55f357d684342df9e0b9d29a009b042f527edd2479f7f8c

SHA512
eeff447df83e84814bb1dcc7712aa2f4f1bd3c5fa48676620b307e94778558773f6642174a84899808cda375bac8272a180aecf03848e8552af2dd120e9666ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
87c671325ffda4091635433f7cf4b3ba

SHA1
fccaf8afb2ffce7b3a09e22dd277f760e1ccff79

SHA256
478f78a4053fe1f3873a3b94ce54f62c47c00919f131a4caa78d09bfec861626

SHA512
a261488a1a9721fc3aa24083e12dc7cbef758f89838400dd097267eaf9e879527f6e0f1e499ff7d12e49de390101d8799f3e5b4e79bcdd6c4ecaf1a838aa221c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7a72ce4dc33e942acd08e79ef30ba36c

SHA1
152ef65f0e093884f5923c6a55733ce433523ee2

SHA256
05cbec8d7236e4a5a5790b026d10431f19e3104b03795e209da9b82ca03f4799

SHA512
312c7990b20c53a4dfe5bd11af8ca6047e0165daa132408c5ed519119d0d3940694eea6e07dadeaba2cd92819f1ef785f281cd1c2c24f7c9e1814d9f65e7e79c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ab3f6fc675db578d22b23a7dd09869a

SHA1
50fb4dd1f75ec52e6589001ae04160ce1f58c6e0

SHA256
dc35927ca9919159dc273a1e5862298da898150db1fb871836b0b0fa4809ad79

SHA512
a5d13130cc25f7ce3381d272b6dbeb12dbdd1895d500fd9f1b11adbf42447b80ee514e5311a00f707e41cc58956b7d067f18374cbe0489d14e3e65dae90aa3d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ddf4b55f153d70dd81aa308f84bb3f40

SHA1
f09f2226693d3675f5323be2ab5b9527fca7f91b

SHA256
acac85a85cd482ba78c36ea096a9ec6186786a6c437aa8453218bb0e1808fc32

SHA512
63beac75eb6b0e8a1527cc971ebe11e619adaec50a676a7b514294e23d2fe1f975c275c091d0f23b7d6a8962629f20331d83b9aa2db0a4590fae33e5f73fb3ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
abbd23685d5a79fea6f278cd3950151b

SHA1
0cb98baa36ce5f85c682d37f22031d556d3ba5db

SHA256
105769f3a7e01928b93a87615b4298b83506212ecef7a5583aa001fe2fe8b54f

SHA512
d5e586dd8af33c5343f25e7849848dc7f664c4ad339392d4e899d031ef032a364b97026b7c6abf7aa1553e3dc79e25c6fde490f379dc9a13ed6fba860778bddb

Download Submit