7e01b87aedfe51d22a1f37a84fd3a0b6b50e5fda5beae4a59fc8dea4f14e4214

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bcb5ee4a6a39bd84c4c19d06be54514_JaffaCakes118.html
Size

119KB
MD5

2bcb5ee4a6a39bd84c4c19d06be54514
SHA1

6b136f3803e8ba4c026ecfffe5b2545d5ca1715e
SHA256

7e01b87aedfe51d22a1f37a84fd3a0b6b50e5fda5beae4a59fc8dea4f14e4214
SHA512

ca1ca0c21a1d4b1441538bb8da0afa08b47940bc9a63b63959074167223f1953eca3413c2c9cde2333509f726dbf44f10b0aef7c677452c3b50a172bce157ac7
SSDEEP

1536:fHDDWRXEnTWKQSlXvrVTIr4WzsDg1SiiGJnsqaYIrZf1EAYXRsrjFGn1i:fHDdnTWKQSLiyOGGJbSUn1i

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
344	msedge.exe
344	msedge.exe
4884	msedge.exe
4884	msedge.exe
1804	identity_helper.exe
1804	identity_helper.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 552	4884	msedge.exe	83
PID 4884 wrote to memory of 552	4884	msedge.exe	83
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 2908	4884	msedge.exe	84
PID 4884 wrote to memory of 344	4884	msedge.exe	85
PID 4884 wrote to memory of 344	4884	msedge.exe	85
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86
PID 4884 wrote to memory of 3700	4884	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2bcb5ee4a6a39bd84c4c19d06be54514_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5f3146f8,0x7ffc5f314708,0x7ffc5f314718
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1952 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13507389704564318145,3625743974425987838,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
46565e3785d60271f186755de29cbc42

SHA1
0ed1bd85c07b7e5943819a57cf05312bf035fe89

SHA256
d5c1aa79c35c0892b82c05c3acd73e65efb20dfceeed6af9ad6d27f4ba366af7

SHA512
55482f3d2e21fbbb23b250786a981fad7c597b1799445dc3a9336800ae3c831e5c66381425e7d5e855215fe48e1ba1662f0be1e59f3104b3b3957c0ec64fbd02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
bfe0b8754710916ac618d89d56e19741

SHA1
fbe71b4f904587bafab71ca9ede8e0c1622200f4

SHA256
b2f2879f40ca43fd048935163e98c38184325c3d51b7540ac2abff3cbafc0607

SHA512
d695f945b7dc38b7594d0457af18dc02a1de80a12941348f7ef4895615c52fdbfc0d042c9ab927edbf58b625b4f5b5601fc493f1cbd390d5e252c0f185bf8923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c578caca14c95310d75de154c7ac1a59

SHA1
d3c0206b2597f27d5fdbd4c099a035c05af86331

SHA256
81cc6783a402e96d8e88696e0c9c66b905dd4c4f060fed0293b8a8dcf3d3ef8e

SHA512
3cd7fe6dcfeea7e3d181fdded48a456c2ea3fb8e3efd9c17eb4aebea6bc73a09f983a32fad992ba69a0eb06212d4b46e0ff4037659a25fafa314b3a68614bb31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6e4408e0a3b1b4a10539ebbed86837a5

SHA1
0c672c56295f39b7752ccb4bb71e1cdb948ccfa0

SHA256
98e57d6ab500504454b22132c99bde26cd25d26c16d751838c9ed00005950813

SHA512
b62be1c75672388cc902d5cee108748c0346c6ce63791d47682a930a4b25dea14626b4c5010d1023769ee26b6753f420b58e92765d7438aa8d8f710d9b25e326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
239f4436aaeb4c07638e1f931fc82d25

SHA1
6efc21abca9f42ba8061e032b2265750da0d6152

SHA256
f7407a823d069d3f3096bc9e092f775f38fe764b14d168d5b87d827039178f08

SHA512
b52a0275c9128400f172e02b5a6144617af9a0bdaf43f6639a4e7b5fb87bb75abff2b381472386cc85cbe518072a7a8229054fe49ca92683fa7bf74cfd0741cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4939318300076cdf330ff1269660a03a

SHA1
a6cfbf88f316744024c297c106adc39d90b68cc1

SHA256
4e34cb9fb2d247d8ff053339cf5e185237d37935062f491a4494d60ef0c9e13b

SHA512
fc4bb45f6040ad6bf1cfeeb4c5769505e5e8fdc591d7e19884387a1d5dad22ac0eb556fe61f9bb3f0ec479a3dd23de95d1626a253f687bac2ea10ac2217c4d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebf9a565d850571fb7f400bcc63bb8eb

SHA1
2dff05610a62e18a61f69804a2cb43b88065e0b9

SHA256
ecc1adb4242e7d6c64a7a2dbe4f35354ad6147f105ae8e1f1ea2d15132a477b5

SHA512
bfce375720d49aeaa2232b15a39ae3e128c943507c2a6ff65904cb2d7a9f2b8c41e6e59a1c22b01fbcb65279f46669f87bbfe9669ae177abb09b605a11cd6f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64f2ddff372a0b4c7545ec15acaa3b52

SHA1
47c2776499b8eb51ee67f61c5f28100f8015ebce

SHA256
8181936d5790e5b532ef9ddd8d315652481d27b326d38b2b9d27f828a919cc47

SHA512
53f86ae56da4d0d5562fd77f9ee20c3a473a54e170c5da9a183882b72ebb2058eb382ac58f8d3fe1af655004563d751e0ed12ac2131d5174dede096c2ed4cb39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d67cbaeb1a99049b8dc94c31ede371a7

SHA1
86396a9d395fd8fe6866e71ac1de4d4ce384a1e0

SHA256
01b23d2a8227957731ae456fb26decb739d962194b1527be5bacfcb294d232af

SHA512
76559ddf5ca715b4389acdb50cdf0ebca3bbc424c826bfb2b2a156d5a9ce8719e6fe400f1a7249fef27b60f170f3e228c697dae337ee5ef35cce5603050f71d1

Download Submit