1c9384840ea1e69d383c190b5343b3f04fb605779da8ffdf238967b6f323e0fd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bca12306b74acc5535b471bb705a6da0_JaffaCakes118.html
Size

57KB
MD5

bca12306b74acc5535b471bb705a6da0
SHA1

b0df0240ca8583c31198f96373efad7713db536b
SHA256

1c9384840ea1e69d383c190b5343b3f04fb605779da8ffdf238967b6f323e0fd
SHA512

59aa3524a1261be9a1b00541908c92898a693b799d636649cbcc19312627cc6bf0bc6ff854999e9c93bbffc269536499bdae4ca466aeb583cd045b343d4469cb
SSDEEP

1536:gQZBCCOdw0IxCL3u5fQf4fIfNfSfFftfMfRfRfCfsftfnfHfkfkfcfL/fUfPfotz:gk2e0Ixl4gQFqNVEZZK0lPf8MUDMHazn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4852	msedge.exe
4852	msedge.exe
1580	identity_helper.exe
1580	identity_helper.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4984	4824	msedge.exe	84
PID 4824 wrote to memory of 4984	4824	msedge.exe	84
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 2720	4824	msedge.exe	85
PID 4824 wrote to memory of 4852	4824	msedge.exe	86
PID 4824 wrote to memory of 4852	4824	msedge.exe	86
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87
PID 4824 wrote to memory of 2088	4824	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bca12306b74acc5535b471bb705a6da0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c6946f8,0x7ffc9c694708,0x7ffc9c694718
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,13488408409430435669,5427250329579508855,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d9a39f5-c827-475d-9575-787999336990.tmp

Filesize
6KB

MD5
826a232a7152c342f7b2dbb45c6f7eba

SHA1
bb52a513fae26864e8174c6bc76bdb9d4b71deb5

SHA256
aedeea5a28dd04a181f026d039625026fd14378437a58edee6117cfb36e7c6aa

SHA512
b4668c378df83685f8dee2875de92510e5f1aa390b66fd8ff2d93fa4d5d3dfd7c7c79d3b5965d9a594a8e3b7af00cb82ab942f7cf46cdfbae8949fd798c4d873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
8660ff5ac28b9c7954e4c8e24aed9ce5

SHA1
8762864c2b0bdbedcb7738ce4a42257d2d06dd0f

SHA256
a096d76d590fb6c291bc85d5acbe6eb32ed34fded5a351a315f29959cfcb861b

SHA512
f80171f2ba5ae39f5c311fd1c19ca2aa1e089e427a935eb692191001b80be60171a881e76483554b93980fcd4dfdaa579fe1056e2b21d42fb755ca9de60fe5ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
77515f47ed84d44b502e63f2411ef7c2

SHA1
e744067126a6171a857fb401434adc3cc8095b67

SHA256
9481473c5ffef434af3245e10ff0a98a8a9de204a3a5d5e591eef3779cbaddb0

SHA512
1032058458e0c9f1bbe4ce9b150e0b9f3b0bb1d8a247e7ed51e2aeccd434df51e24164555ea75d100d24e983616318f126ec4f8abb1a82910f0d371ba66dbb53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7ff5f5370c9afb911bac987dad95cd26

SHA1
5063db71df9fc305658cbdbf58771eae4b38bdc2

SHA256
b05e1013f7fe7d8b6eced4c49804942d8b8a1850c586718bccf8d35b8c9990f7

SHA512
3884adcd6d119781d1ebb2a1249b1bc0a2e2e7d885e4bef1b1fa7b3ec9e35c3bb2a5fbda153e6aa74261ab6b027559330ab3e55dd4af4452f7cc4a486b9a2811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5723e8ab939e8bc640976838cf5684b4

SHA1
39eda77b1a5ddb80ac85bbe394a6cc773ad80495

SHA256
48032de21877571e9210e8f2378be94b0aca348ac5cf9d10d94912b90ecea197

SHA512
43d02f7ee8f3e4e064f96ae56f6b82f652df4a66567e71488648ab7689c55e497f0c3d21ea0cae3fe05beaa5c234d8ea1c6dffb57636b60898a5e106c1e166ba

Download Submit