e8fe9cae5db49bcfdcd76118321efdc34bccf5140f56540cf0ec26f2850e772c

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0dedbbe5515b32b936093b6ca95d43ba_JaffaCakes118.html
Size

175KB
MD5

0dedbbe5515b32b936093b6ca95d43ba
SHA1

93214328d5b2a5819d7854848de8f7153f2b5d0d
SHA256

e8fe9cae5db49bcfdcd76118321efdc34bccf5140f56540cf0ec26f2850e772c
SHA512

954f1a6d756f8f0b205eebd51ec8e1bc0d719b8a36d22879589d526b3ef668ed52188f04b43eeb1cc760597de5d09380658d5acab6547f75c8358c2ba2f1a32e
SSDEEP

1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3KGNkFRYfBCJiZw+aeTH+WK/Lf1/hpnVSV:S9CT3K/FkBCJizB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
700	msedge.exe
700	msedge.exe
3284	identity_helper.exe
3284	identity_helper.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe
700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 1548	700	msedge.exe	86
PID 700 wrote to memory of 1548	700	msedge.exe	86
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 1064	700	msedge.exe	87
PID 700 wrote to memory of 2740	700	msedge.exe	88
PID 700 wrote to memory of 2740	700	msedge.exe	88
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89
PID 700 wrote to memory of 5056	700	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0dedbbe5515b32b936093b6ca95d43ba_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd384246f8,0x7ffd38424708,0x7ffd38424718
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5321424680256290303,6525858003462019000,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
ff942e1093513bba87050f2b5f536910

SHA1
63959cb637ecf56560517c7b1baefdd9cbcc3846

SHA256
dc734cbde718ed2ce65448af56383ccea4040ce959f0c133168ec8635d747562

SHA512
e1ca8f4f39839d052456e9dbc9cb46723670de5d97f41f8893b2dab4ef410057c73f1fe339d0e7ae39d0fbc03fa8874f8e163721ffd1c9048e2860c8c4aff914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a86f867fca2e13cc9e60743b6d2e41cb

SHA1
d2f76b0d3ceabddb5184193361cbaece48935b7d

SHA256
5b6219a02d98e591ba45c4920cc6ed07c5cb2c8e0fd5cbfa08b6eccb971390fb

SHA512
2b88378de15507c9a2f7ad71011f6cc1df1d7e2cd23b2ba6b87e45b22436107ae1bc087aba1bea20135ae0027d3dc7f7bcd8a8c37dbd7fb973c0679b591b3ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ac4663e2aa7986fd983ccba7c2b0b519

SHA1
483abe2818c17294fbb43e1a2fc00a5b5e091a9a

SHA256
d01d76b5c180061d284e7a19ac67676a4d92834e437cc119eee70effc7702dfb

SHA512
49e85882d81b80ed13db910cd2873cd7cae57d8121b3f5c3d84aed2555488a6e05d82fe9d2081b12816fc50d2cc7b870bb4f2eb5c3ebbd250befd4de606d07d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b989ed60c83e00ad63818c617d2e182f

SHA1
f71fa6d4532d1d5bb734ab4af2fab49284213db3

SHA256
db385ac6c4e6e6e93da69c37dedeb0f21e5beb861f66d0e28c3f4df7c45941d4

SHA512
1bd34d85b71c5d6b5b32790149066c039d12867959747bba7ef8f60ddd1869502605d5701bf75e90daab42dcb4b57f5ad7c529dea395fc0475701d1c4f55b798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b06f8ec4-45eb-4b75-baf9-408dac46c9a0.tmp

Filesize
5KB

MD5
6d74c9bb17fb6ebbb07350722800409d

SHA1
88347d0b7028987bbd916e57156561b5e7c2e456

SHA256
16ac7beeced14928bc5d11119de82656cd3c1d937f4b33ed88659f3128429072

SHA512
2ea15d19bc98a08b0e5c5732ccb41b173525689f1c734013ad6204e1a3320e1c3e37d44dd10d0b612a97387835161b1719c9dc84ad7cdda696038779e9029e30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cef8b0f87578d3e1a847a179121ab617

SHA1
4af91c95ec2d93b05cad9657a5b39708f4ceeca6

SHA256
2f6e13913093e6fd0a50c2fa7e4b1a8dd57ea9e30362e0b1adacb72884197c9e

SHA512
a526ba76ca4b70480dcb41021e6997fa516babcc4554ecdb91592d6983afaee42f32795a150e21bee2d882cf34887377671670a2e1c05373ec9d8a41ce3ec359

Download Submit