f8936398b65536acac9c7b087547f0b0a3d2ce3a744fa8d086cb9c9ed4ef6e85

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f8ff9ea1e321abc54aa55a372595c89_JaffaCakes118.html
Size

17KB
MD5

3f8ff9ea1e321abc54aa55a372595c89
SHA1

dcf1859d9d03475a1cca8880aa00055037a05d61
SHA256

f8936398b65536acac9c7b087547f0b0a3d2ce3a744fa8d086cb9c9ed4ef6e85
SHA512

87edb386f3f666bd2a82c141a36ae4f8b09d3204603b3acd8a19ff5b5b4ef06bfa8c3da1a6d525fb2330cbfa74469bcb6bb1b06d7bffa0ce1a8d3680736a84a7
SSDEEP

192:b4UuMwmOQqjhecrxqCRtUu9iCHMjVd3QRSB1SV/5Sm7uRPiJP5vdsJ0zS:bPwmOQql0CHMQ8uqMJBVo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
1204	msedge.exe
1204	msedge.exe
936	identity_helper.exe
936	identity_helper.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 3380	1204	msedge.exe	82
PID 1204 wrote to memory of 3380	1204	msedge.exe	82
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 2040	1204	msedge.exe	83
PID 1204 wrote to memory of 4956	1204	msedge.exe	84
PID 1204 wrote to memory of 4956	1204	msedge.exe	84
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85
PID 1204 wrote to memory of 2608	1204	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3f8ff9ea1e321abc54aa55a372595c89_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc002046f8,0x7ffc00204708,0x7ffc00204718
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17698243064251623876,2180771063856940238,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c84d540-7ceb-4bb1-9819-3f50ccc69e54.tmp

Filesize
6KB

MD5
577c9cc919e5151141d0408a3e3e430a

SHA1
b5deccad82339031b04fe0ad637b417049d9f1ac

SHA256
0ed5d33023b887bb07f2ebb9c7362eb31a51f4f94dd20bb326f29b244d2718b6

SHA512
1c1998ecbcdc75f2361a55c39ddbb11a6b359ae99bd42dffc07bf46e4613aa721dab4c179306b31510e83ac56beb1aff8ed5963ce60d25ae8025fb166763a833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4356be22-6910-4a66-9b72-ed45185f606a.tmp

Filesize
6KB

MD5
6f44a8d7a090a39de338b41e7c6b2472

SHA1
97ce4779bf028e112d75fd66fbf84bb0a4da157d

SHA256
79c40a3a8c5fe7ccb6b7f33142f31e50596192a0e7016cb89f0950b307245170

SHA512
60fe7852927194146ff292fa93164dad9af6ebef599b1f7b0acf669461a961bce8c23aa92e92236e25f29e8818dac1e61c35e7cf0730de29e997664dfd87a476

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
e75179806fdb60b3337e8cd5b04cd6cf

SHA1
434a695c7607996cc4d1a0698d9214afe4d9fd38

SHA256
a121c6f8b11a0682ab639049f50ef2a1b00b3a2a565d7686cc64f501056b7b19

SHA512
e1e2f888005696fb33453f369efda963c71c15270338db02d812a1ad503c1dfd2a0f693c3f6a02ca2abb7cad631524b0481141646353c7b39adf44b09bf8464f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9dacf4d39dd4a2d6bcba53c13f1d896b

SHA1
fcd8cce729bea209da9368ec9001906c5551768a

SHA256
a3915aa90b80fbd726797d25ad0ceddd23d9230691345b45dc7d99b33f21f20b

SHA512
159eb43e9193f581952acb3bc23e0c276a8a6ae2324c4c8b2788b1e0b11a18001a4de3d183ae16c9204bee498722362d6dc46c7b8bfbc4f0acbc98deb26082a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
a0fcbd6ed5237eb19d24ae72fe828d02

SHA1
d81979bff33f82a8380a9f31b7fe24c683adf263

SHA256
7836bed6b1707338e119dfa286c939fb4234b82ed7aa7a7443dcacff825ef930

SHA512
14bcdeea6c9d224b5504eb8ee3d344951d0d43c92cd81e38fb2a3a774175131182293f3ac8568fa61fcbd7e2027ac3fc17cb271fe58642d2266a906f6435b35f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
d3ff6bfa87849a430668a4117d6b3f26

SHA1
752de12799170e7c684f6c986dd0c19ce9806b32

SHA256
6c9cef0e9895bb9ad3b5e8cc54c8c0b4e2eba4a6cc0f89e5ed2c3f53c255a4ec

SHA512
1ab652b0ad72231b4337f22abfc0c4c9f549646fd68b59343ac75442b57b3a0689c5db946c52f3b9eb0b2d9f50394bd8a2924d0980a4754376d32c7081f34473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bf1a.TMP

Filesize
372B

MD5
8b24dbed7e7fa6d196787d96c9868af9

SHA1
411a6f1d5fb403cac2ff61bdfe0e8ff170619507

SHA256
3797707fa270b87bb16acbd05f9a8ad72a1775d9eee6c16696e372b4a32d8437

SHA512
fecf9e652cea3c4d0eae87b534a7fa9d9f23221f636d4f96f2752104b7353dd9511229c59ae3d712aea24b9b355a626b12ff23085dd945a948e43356c68b0e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8df8447f6ff717dd7121cac6d9669350

SHA1
27783c332a9d5b73b1365e323b3c4b116c9cc814

SHA256
df5bd21184397ffd19127445efaf5981249d1a2c9606a74acccf056951754833

SHA512
a9ab8178e66af46c12b5f527a02d992b8d613aead038d03cabd0a648896f33b245b642910f2b09621b6bd400c72129c6ad3bbe2ae196527248013f9d728339de

Download Submit