57bd11bb29cd2ec2e608aa221defa2d08a27000b602a1c883cd7c51947232ea7

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8cb3acdc4ac70e0dfb90c8bf812e554_JaffaCakes118.html
Size

34KB
MD5

c8cb3acdc4ac70e0dfb90c8bf812e554
SHA1

e695055ed07ecc95c282f43b08b42f3e64662f0b
SHA256

57bd11bb29cd2ec2e608aa221defa2d08a27000b602a1c883cd7c51947232ea7
SHA512

22e70f7d49676e62436abda8215de37cd4257464a9007da213ad51a03bcd47fa5458db80fbc7df07dd5e0aaae9bdbaf14c3bb637ed3e0aa4ef8e174f27bc3140
SSDEEP

192:A34vEvF/IBAwphbX7/SCtvuXpUXErT1d4+8z1tmcakZzjRkW2VJvlotGW6rYpy5E:nOmCCtvu5DMEwTj2v3TnSl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
3556	msedge.exe
3556	msedge.exe
5036	identity_helper.exe
5036	identity_helper.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4480	3556	msedge.exe	87
PID 3556 wrote to memory of 4480	3556	msedge.exe	87
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 5012	3556	msedge.exe	88
PID 3556 wrote to memory of 2440	3556	msedge.exe	89
PID 3556 wrote to memory of 2440	3556	msedge.exe	89
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90
PID 3556 wrote to memory of 2832	3556	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8cb3acdc4ac70e0dfb90c8bf812e554_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2b9046f8,0x7ffb2b904708,0x7ffb2b904718
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14735149916538755919,3361126330778215838,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3fda3d9b-c714-4716-95fb-896c31f0ab36.tmp

Filesize
889B

MD5
906cf7ae7cb1f06d6a34c7e2e9551d03

SHA1
da0f2f50348db59b6dc39713671d04b19ececc48

SHA256
1b19d471ff81711ea09b741b8514250b7a51e07f5de008eb07ce445206bc5b66

SHA512
6ab3610ed4e9dfab290c1943730cf6754f62c74695c1abf6e92f2af456cb4a27e627fd52f7066ca44ebbf751ad6b3a839b8c9e4f5091109a2bff267432d97c83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
51237a84e965f59c195e72958486b6df

SHA1
89b028f141158c3ba3181a8e13bee813222dc899

SHA256
253fe732b0812703cc887b4eef2c34ffece96d0438f9c954682b4aeda711e061

SHA512
abd7124fc8e6013f2bab51d384c1676eba35e11d5ab75936c055fc3e53b8cfbd6a9f4b54d901c838b807234cb77b8e67f55008d7b46377d457c666ba9528be27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2592533d3fbc1aa0aa886cbc6b48e199

SHA1
61cfc8d0553b9b063172aae06337e46c261b03d2

SHA256
e0238a9e28bcda9572f85a8d20a70bac674bcaf444081eaa2adff90a357d1fa5

SHA512
36a95371f1d70c59325711cb910abc23998dc0d038ada0e48083cd5de74ec5a43b3c4640510b8983cfd451b88daaaac4550596f5f816207fdd79904369498a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d279f999d481808e481ebfdcaf54609

SHA1
e62dc4d6bd4cca1a5b0fd1b5e2fcf5dd954d7c0b

SHA256
91ab0fd129f308fb442237bcc83495f995458bfb6d9c6540f3e0138512adbc6b

SHA512
9fa0c7298bc2657fca3335c7e960b397faaa04192835b095b32180c4ea8de68444ac216bee1e6e15cf4cae723be988624806cb4ac2228aa1b7eae1d8182d95e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
167751daa3926e985cfc9d11b4610306

SHA1
e0f14e5acde30219ef68fffb4487d5c2409799ca

SHA256
db4f50f7ec0a354fd122ca2a4017403f33a887b4e7cab8ba6b653cc696df4c41

SHA512
7117de367f280387d27f8c4f7b2a3224c2a5fe0d50a0deeb5fb1d16392042cb5882327ae9891f05b2d4dbf42c1a5f79a7f6591f6d6b3840b2d9c2b7c2fdbbe45

Download Submit