16d782dd5bcde0251d4e04cc6a34b13d37f76293bd080045585ad023fd5515dd

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5cc84f1d70688d33226ac8e1c16b437f_JaffaCakes118.html
Size

56KB
MD5

5cc84f1d70688d33226ac8e1c16b437f
SHA1

1a563d8a32fa037fea137ebb48c939648526b34f
SHA256

16d782dd5bcde0251d4e04cc6a34b13d37f76293bd080045585ad023fd5515dd
SHA512

3a767ee58559bf1309e8ee906150e112fb0410554534508762976e873d11f303186e4662962f22de8e70c771430d7e1c790ed62474d2afd36168cb5551218ec4
SSDEEP

768:Zcd9QZBC7mOdMAJpC5I9nC4h0obKVi/HUziPd:gQZBCCOdF0IxCK1x/6iPd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
928	msedge.exe
928	msedge.exe
736	identity_helper.exe
736	identity_helper.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 4284	928	msedge.exe	85
PID 928 wrote to memory of 4284	928	msedge.exe	85
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 3672	928	msedge.exe	86
PID 928 wrote to memory of 4156	928	msedge.exe	87
PID 928 wrote to memory of 4156	928	msedge.exe	87
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88
PID 928 wrote to memory of 1620	928	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5cc84f1d70688d33226ac8e1c16b437f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ff946d946f8,0x7ff946d94708,0x7ff946d94718
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3514486328197836054,717420820966921212,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
388f41c9bb2e55cc4e6591a84ff2859b

SHA1
96db2ee588a96230145cb18d31f0f92a36d456ff

SHA256
1b301173bf414de125b300ea942142d0a2c2129973fa399b25dbf372f770d2b7

SHA512
fcdd5a06a1af59042d0a7eaf9202460add1cbbfa2fe6e9360be25194c49c659f82eebcad587719b8525abc37bcb7c73fdff3c274ed3ee815e7cc83b753ce95c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bb04ba734a99c77b1535d0630199f363

SHA1
00bd765d5574d441be639a167339032ea115566f

SHA256
679623fd0cf863ea90297b3f9ff5f0da5bb2bbe5b3d85ba720b38c3cbed18718

SHA512
1ec029820635dd47ebcaca95164aa3e037466475694e303a40e3651006aae511d0c5e040c9eca9701599962417e1c56e324969d7ea99c2dafa0f98bfe870cbd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d33518e63fde7210f964316a99313b2f

SHA1
d7882d07864dd385046fc25576e295d8aea511d8

SHA256
6032e875bda464b6f931d342a5be972d2f1fb550b3b5934a2a0ef5444383f033

SHA512
fe77f2b7bc812dedd45edf95f266d746694e53610756bb519b279d43d88ea3a25ac80b86a7ab387bae3298762f8a090364d292c0616f201063f8a1788ae39132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b688348d87382c1d1624d4e8f629080

SHA1
603719b179729f723e2e5c4ae23870ee2cdb650d

SHA256
addba61a3a2f79333acad5fb2068a1230694a87cde3aad8862cad3eb2bd549a9

SHA512
21478e69958f64b529e006f2e3cebe7782ae1623bec318b977cb0d18135c0a6beb4a4784d8cf76432914a43ab83c7676591fb2068d8dd2c39cb8955b21f755b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
124823e5839c0e39caddfc7d252b3176

SHA1
85232146bced18097e617954a27f3c81ea41eaf4

SHA256
d805a5f5d8dcffb66782385b45e45fba216a0831d2760427720fa289b0f72bff

SHA512
f727d91f79fd46a0dc094962ab35bf4d055366b3047032d472062605927ebed7a261b77a3ff2be6db3cbdd23c3d639a1e9efb4c60fcd2d77fb9bba9bfdd1414f

Download Submit