5a1fec531488ff7ff256ba772e1c68e3b5dd9e42dd71cf7a8069c20bf95b4722

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22aff35e999a7a7a5d47b9babdfb7c1f_JaffaCakes118.html
Size

58KB
MD5

22aff35e999a7a7a5d47b9babdfb7c1f
SHA1

0f0dfa57add77c4368c3d972c31b3423774044fe
SHA256

5a1fec531488ff7ff256ba772e1c68e3b5dd9e42dd71cf7a8069c20bf95b4722
SHA512

c584489971ee564bd5b956492e1b4cdf955ce0d66a4bff3208e41eb977493487a63be2de069fc03dc9795c1eb5e18b394c42eedecd377eb32fdf216938813e78
SSDEEP

1536:TEGwpwX8heCEZdPhajFi4o/LzAuwKGqLieIHjW8EmdGp:Qtwicf7HieIHjW8Emde

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
512	msedge.exe
512	msedge.exe
1776	identity_helper.exe
1776	identity_helper.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe
512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 668	512	msedge.exe	83
PID 512 wrote to memory of 668	512	msedge.exe	83
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 1016	512	msedge.exe	84
PID 512 wrote to memory of 2724	512	msedge.exe	85
PID 512 wrote to memory of 2724	512	msedge.exe	85
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86
PID 512 wrote to memory of 2580	512	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\22aff35e999a7a7a5d47b9babdfb7c1f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90c6e46f8,0x7ff90c6e4708,0x7ff90c6e4718
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,9519001488647387143,5688837408156234153,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
7b4ccb9a55ef4694fad2f5d3d7f02158

SHA1
9e332458705ea1fe60f64cc6eeb2bfbd62d5da19

SHA256
0c5143e3b7171966b539cf3f0fcfcea8a7a9fd491464ea7cc5153246a2608f01

SHA512
06961330fbd2b6c4d0d0e8b0950f56a8fdb51d0eecb94438f65c4ac98c2fa6b40737bc84c4617ba2bbb64a34302699c9ad02d221fe2c3febd9e172c08379face

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
44a0690646a5c317d2c8391ca5b6ddbb

SHA1
238d648a98c593766e54dabe9a67950b1c8250d8

SHA256
b851a659c955e23555d5f3308d63d4b76d3ce90b672f93777e1688040aab272b

SHA512
5552e69d15032a3a3c37d0b4cbd617f6bdce0509ea95ff425089e6062dff39abb792bbb36ac3ee45b630b5add1d2c573f2c6528d79dd05332a97380eb31e38d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b7cdbab32e6faf55273f0716715e64f3

SHA1
965682dc631f1a1e0ca77f56f068953ffe11e851

SHA256
5469f05f1e75c48f2bbf9eafc326fe998c6a68cb0a2e4e404adfa5854f553d83

SHA512
69eabfa73eac8d36e79063a37020699a3a2379ab2efa514c67956c180495a5d578b3012040021258234457c902bd2f2daf47c4ed06df123d96da25958b25d810

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
466b24dae56f737eaa75b9a930c72590

SHA1
8abe1dd2b0545c3d83f0c0477061c5b623e111fa

SHA256
f0666a3669dece1d5c9136dfbbab3c16b6efbd6eaf28ef59644bfd87f404215b

SHA512
2544d5ece874ce466bb98b02d262a2441b89f67b5e9eef2d5d7699063913c67002c0a2dfab3de93a9bd39ee1d914aba289c154678293770edd642b244ce423b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8afda895ce8dd71c0cd8e3bd774303b9

SHA1
1082f35933805b50c3bbd3a825ab83a902d28f8b

SHA256
227a1e62c2200fcd6fa44913f7f3c36d2a7f3af25a35ad17e554f9e7f37fdfd8

SHA512
6bc90c32211fc7053f8e76af86e95db7c1e435e5b352739d881cbbd17a91adbbec3df590821fe897e3b7d7b26d7b60fee156bcf4270bfc61c3426171e98e338f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b25ace9b8c916cd02caa081bf706a0ce

SHA1
68d3e9d07a7aa97baa02ce763a28aa525daf2959

SHA256
6dac2f932e113ebd2b4f68acc76173bc238e12ecca56a8b577ec6a28977fd41e

SHA512
304508961a5eccea59704a18c5974e5e9ddbb22b3705e22d21335808e09e2350f15c25999e9f9e18bdfda021d22a3e6dc60d97614ff6c2821a1411ba99297b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
367a81f33e094cbaa4252714ec90b5d5

SHA1
5983a56e1db574914d67b19111e293f4919cc2b1

SHA256
cc212f396e88f8a0ae1daa81fc75fae0db85be4ad083ed424466758faa457c2e

SHA512
cb644a2fa2b7813a4a1751a84a723d9e9ae4d38b58e5dbf2654d9f959cfca2ee651e418f62c8e9ee453888c105496f8e1ece3a54d8b73e87567c10b6ae57c4d5

Download Submit