70956b421216afb0c3cf3a41f49fb4086ca39d577ff49980f5fe4526d5f218ee

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0498399ef86899e0e74b1a9cb6076931_JaffaCakes118.html
Size

175KB
MD5

0498399ef86899e0e74b1a9cb6076931
SHA1

6f9ca1ced13fda250410eff41ca6618cfd3e63f7
SHA256

70956b421216afb0c3cf3a41f49fb4086ca39d577ff49980f5fe4526d5f218ee
SHA512

493947b7e0f90538be7b9157761fd71ed3484e05760913b76d372227dc7dc9536d42d2b9363fa6f899eee9688766760cd1ae92975c9f49b2c56fe198ca7372cd
SSDEEP

1536:SqtY8gd8Wu8pI8Cd8hd8dQgbH//WoS3FGNkFDYfBCJiZh+aeTH+WK/Lf1/hpnVSV:SqCT3F/FaBCJiwB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
664	msedge.exe
664	msedge.exe
224	identity_helper.exe
224	identity_helper.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 4608	664	msedge.exe	84
PID 664 wrote to memory of 4608	664	msedge.exe	84
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 4080	664	msedge.exe	85
PID 664 wrote to memory of 1908	664	msedge.exe	86
PID 664 wrote to memory of 1908	664	msedge.exe	86
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87
PID 664 wrote to memory of 3764	664	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0498399ef86899e0e74b1a9cb6076931_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8cff46f8,0x7ffd8cff4708,0x7ffd8cff4718
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9223224861008539047,9212983664224310152,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
c62c30cd794b75ef0cb8512c2793600c

SHA1
2ac242f9e3a910576f4077a6e40161ec03d383c6

SHA256
191f0a5d31d757607bfa172552bad73c1b5ca5c6008bafa43a49b34b92b5c500

SHA512
3c617e461fd43591a30b8984e96db91bbfd462c2b389ed3578823b4688b084b7fb2a99bb5c4cc2bbef30d0647c392cb907d0aae5a317fdb3b0fc7bcec687ed3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0fa69d77de918d1783e96cdb47dffa72

SHA1
3131baa007fa7bede174ab9a537fb9cdb42d597c

SHA256
865cac711a82f22f8c4f5d7d550c0c62361d147ffa7ebf723b62e5d1404eed0e

SHA512
1507dbb91614ca89a42c967850c1c7f68f7bf7ac0c6f6861729c5f53b556a4161ae2519a753cab4cee570cedc3daabadd4579929db23e99281d7cff78f59db73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e666547e1b3144e5465ba09386f02c37

SHA1
c1449ac6aca412bcf1d649bf75023dceea34f90b

SHA256
d9c7506278b41d988801741e5bf8d84a74058bc2b6a0cada2351b0284b70902b

SHA512
10660c4b6b5f05742063f4d4f6024bc978c85ebd85524da8e850db8ae1cbdd847217cb4ab7d6658f29dd7e1a7a9d10638e9541c45a06be62cfb5b35e3aa9fff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
55e0466b8e7f5c346068223b379e5672

SHA1
35a3009cb7c23db99d3f44d3cffb9e8baceafebe

SHA256
fc5f81a5ea346f5c3f226d5f10afda18a675c26323db85c7904b87e6d4fff3de

SHA512
4f8d37351e1cdf81ef03b2f94166e2b5693531bfc7c85305f8efcb5501542506a2f558446a23aeae61e99d83f38f833b6d0554e21bc1941e5dd4dbc74c30b3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7f2c6c1-7118-437e-bcac-057346198449.tmp

Filesize
2KB

MD5
04c2cd143c41652065ad4a4f819a2481

SHA1
aa465c404761078b9b08996a10ee117cb392e763

SHA256
c385b6a4654caed0b1e1ec6aa3ffa2d825476ba3a39eb093ba64310e2324365b

SHA512
bc88a489e146cd20895eac059e8bcc3da95fbaaeb29d4a996ba9aad3998aa74dcd29a63436764b1b9ce6edcc88c7618ac9e8411dd505d35cf422657228d88671

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0e6342c10aad310c8b5c734cfc2d54f1

SHA1
b7e4f273a10a170a8144ec9a5c865f4050f4a65d

SHA256
d3602ef7d841fb3f8957bb5af2ed65ac70bcd81175bafc79fea208ec40967d7e

SHA512
a11118e4fa6b38686245a0b4acfb9e9015c497bff8a53b11c0b0ea41148817c0d1cfdaf958efa74e7d44def709f427678e3e5150ab302763acf4edaf4678f920

Download Submit