ef0bb5ad3cdf7d959bef069455e8a236f914fae481725ae99c71af5f7e49586c

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7a416f75db41354b0ace4ffef48b123_JaffaCakes118.html
Size

11KB
MD5

b7a416f75db41354b0ace4ffef48b123
SHA1

e57f10f218eaf4ebfb1732fd093166ab7316dc2f
SHA256

ef0bb5ad3cdf7d959bef069455e8a236f914fae481725ae99c71af5f7e49586c
SHA512

8ef887a83eb2f3db6fb90da0b09773c7f42e6e9ff6c518849bb7f35b7ccbd2c053834e3fdaeb5bf91ec3c3a4b3b4fc1d8bcbcfd3920b2fa93f16e6dbe03b1460
SSDEEP

192:SIHpsaVBRdKaBAVNvG6KpWs9lPv9NfVK4Xb5a6H88qm/HpsBw1:SIJsaVBRdKkA/vIWs97K4XfH8e/gw1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
4080	msedge.exe
4080	msedge.exe
1004	identity_helper.exe
1004	identity_helper.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 376	4080	msedge.exe	86
PID 4080 wrote to memory of 376	4080	msedge.exe	86
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	87
PID 4080 wrote to memory of 5016	4080	msedge.exe	88
PID 4080 wrote to memory of 5016	4080	msedge.exe	88
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89
PID 4080 wrote to memory of 1412	4080	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7a416f75db41354b0ace4ffef48b123_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd101246f8,0x7ffd10124708,0x7ffd10124718
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17031808466070607409,10321802033136715554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f00d2ceabf3df2b6cbe8e3b306435ca

SHA1
213f6bbfa3df73d8b6430548f1014c6bcab7403a

SHA256
c5341886d902e830afad0203458b84151758e0d5e1e4285dcb3e5643eb49227d

SHA512
0efc315a1ac031a3c23ab61103bebf763a56999440e376293ca859131e7dfaa78cc0d1c1e44c6fe97b25138154acfe8e2d201fbe761b5bf26e12e4e5d1720f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ee0d6738cbcc711783f22fc63ac80f0

SHA1
ec3dfad51169a8969af8627dea90d285c9b9ea36

SHA256
2b689dbca175877f062c46c7dfba837d7843dff27d719e3d872b94bca62e94d3

SHA512
745dbeebc2325ea77101c8a20f80c734461d2c3095f6bf69ef75c9b8d7c1e597f126478d6c08d250edfa3903e910ed9514544ebf4359f8d22e71dbd3fa9b7612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bb58d735ac71b35c5bf8de523445c6d

SHA1
33161d9e074bfc8e808fee864335e5377abf0246

SHA256
17fa4e5deec8dc9448c8df2af6313699feb9ebf9f3726f012205372836a8714c

SHA512
cec868d77712a7b3ccf7e3593dc1a264b17815d0b07cb2eb3c9007811140f51bfeaf154732fbcdd25ed63f4d3984adb527d6336bd9ada7ba85afe3d43699ee9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
850fe45c3e1aa9797a94ab1629ce8eec

SHA1
b037ab2dfcf1964e93b61536c31354f16e334507

SHA256
6b59b72cbc787b9af5754d82e5758ed5ff33b80315e3f093ead57762c1bf74f5

SHA512
e9cfab515d2b491f4e85304effcb2733ed6b45ebd47dfabcc71ea21f97854d0bc783e516d8297a5c5f0f9b0da029d51e807dba787ef528b2cf4019b093e2f1da

Download Submit