5876363743e9f82e5d149eabf1643a0d37a8c68171aa457ae31cb5b5cb323fcc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8221e7d9282be72a05c4a790c50209d_JaffaCakes118.html
Size

175KB
MD5

b8221e7d9282be72a05c4a790c50209d
SHA1

0fc75fcc7e6606d03a6953bc09cac423db907577
SHA256

5876363743e9f82e5d149eabf1643a0d37a8c68171aa457ae31cb5b5cb323fcc
SHA512

559910deca9174dac889307406c6a18e0276abba948350649bfefb8b8793774166e11b96e8aeacd63ba676b8764a6a679064686bec939ec96a16ec9044d66d50
SSDEEP

1536:SqtO8gd8Wu8pI8Cd8hd8dQgbH//WoS3SGNkFeYfBCJiZC+aeTH+WK/Lf1/hpnVSV:SaCT3S/F3BCJi9B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
412	msedge.exe
412	msedge.exe
1164	identity_helper.exe
1164	identity_helper.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3460	412	msedge.exe	81
PID 412 wrote to memory of 3460	412	msedge.exe	81
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2272	412	msedge.exe	82
PID 412 wrote to memory of 2872	412	msedge.exe	83
PID 412 wrote to memory of 2872	412	msedge.exe	83
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84
PID 412 wrote to memory of 4920	412	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b8221e7d9282be72a05c4a790c50209d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93d6e46f8,0x7ff93d6e4708,0x7ff93d6e4718
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,3575092648917300109,7059279470925164355,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
6bfd24ba6c13d8db381d037c0dba1faf

SHA1
46a196062f0e6224146a8c9ee263aa5dad8ae10e

SHA256
1c1843dbefea9bd1b9d44e9f5bfffecf8aeab707657dbcc7ae9491bac1d9d208

SHA512
9c4fae219d15ebb7bbedaf3e522cb5afb56e7d6e520ccfa1bd1fca68502ee73402838965aea4316edac339470f8ee3c9c1ff18ca2f017f37f4667d137b374aab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7fc719c390562a84e643464998e5041d

SHA1
c3488cd8bb655df65e5a637218293c3f3ff00158

SHA256
ce06230dd71c0bc256c0f7679b1d7e7fc4681558418a369ff6885a3298909ad0

SHA512
bac1256093a7c97d359b8fe8957c7f2c6ec027042d0133e6c0d01db029d7c8be8536f289a328d433d5ebfdb2a67346d9085699f0028d0739540f44aac8c2300d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
92f18f474342b3623551979da42bc0f5

SHA1
d057fc5fea602dbef6caa6e193543fa575beca41

SHA256
3b28118a679cea9227e0fc08ae6494987d92440b34005b8fbe3a6b593a463c83

SHA512
f3ea9b3ecf857da1b178a4a80ae92ab22f498bc500beef2622c66d847942030c23ee651abe23b272a30d2c31ea9bb718ee92a8fa3a8f03fb9160a8f0467c5e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e1e3b4a5fcf812ecf9192c964db62d55

SHA1
3145c4c9300c0a4b600e57b8555741170fa5978e

SHA256
af35c9d3932429b1a8c8a4e0c368fa6d3a5cf11806f99cfaef80c40ee34b46ca

SHA512
14f967dc320f8401e4c3f524684f6db66de55ec4d06499eb67e728a466098f154752b49eb395628a516e0d14729aad4d910acbec02bc98c4b3f9f15751432b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
06669d0d5220e5d6622c867ff14c7ca9

SHA1
6f895826fd76a34785b5b31eebe74e5ed7f0a4cb

SHA256
ba47922b9028c997d2b0b58ea0c05dd93644eb476fc60cd42d07ee9244c101d9

SHA512
d74bb8277ceb8b1c216e8e8cd68cf5255a8db6d915eee3c767a4c2cf01d2ce1ce8f6af42d147297f6394366ec49754d683572d24e2f3665e4db2dbda9158c0e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a2f83df110380062e7259997f90db341

SHA1
74f675dfcf024fef09c444c7e471a3abace33f86

SHA256
71a2b84dc797c926f62475cb2de1a8b6961166b10c25b1658732aec68b57dbfa

SHA512
c24f3f647fe35eeca0e7453a4dd1befcbe8b13fc6aa8a456596b1846e69c8d55891b93829c95800b08a59c7af291eff10d44fd4c2cb550927e0b7666e00208d3

Download Submit