ee6a6969fbc3dab01c8f786f372f52586e1f192355c5d37cb30b0e09e8de2784

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfaba310a6807947b58389b09698a30d_JaffaCakes118.html
Size

42KB
MD5

cfaba310a6807947b58389b09698a30d
SHA1

a79cdb890015faf36fc2bda31daf12c724b612f2
SHA256

ee6a6969fbc3dab01c8f786f372f52586e1f192355c5d37cb30b0e09e8de2784
SHA512

285d4ee9bd311c3257d94b450e3c2a3256540cf8ff2509424d25bf40b49e27d40be508b4fc728427b3580fb53e5aaa1bd4d0d93a9b021037256327982188e1ac
SSDEEP

384:S33j2LaIDzwA7DblQLEwpx0bKsCKuzKYxwKn2ihKARKssKj+o395zYRn:S33T0cA7/Ks1u+Y92NA4sjj+o3LzYRn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
3344	msedge.exe
3344	msedge.exe
624	identity_helper.exe
624	identity_helper.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 3836	3344	msedge.exe	85
PID 3344 wrote to memory of 3836	3344	msedge.exe	85
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 2200	3344	msedge.exe	86
PID 3344 wrote to memory of 1136	3344	msedge.exe	87
PID 3344 wrote to memory of 1136	3344	msedge.exe	87
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88
PID 3344 wrote to memory of 1380	3344	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cfaba310a6807947b58389b09698a30d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffc201b46f8,0x7ffc201b4708,0x7ffc201b4718
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8747815462599369338,8388632717935477406,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
e90e6e08ce736b8540745f65271a9d05

SHA1
d51f58d5d3a3d9bdda108e1ab1177608c0fae601

SHA256
644d9f85eb65fb99b0acf2995532631725ada4a5da50f038fd85f7e2e870de41

SHA512
c33b1e37fd47c3451099a4f7721f7f1adc96a44699baaa5e25a1775653c6f0b845744a04e0bb54ef1504cd5b109ae172ff02bb08fac52fcfd3e203e77169d4f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c9119fccbb071f7e743bae1034d63ef7

SHA1
2755d648a6398cb2163c1bfc06a5d9a4a6dcaec4

SHA256
21b82db574089d5e8a3c62bcf04d5c6abb806517386d7f0d21cea208c7cbb5ee

SHA512
6f1217d5a79b6710b5da094513d2c776f079dfa6edead108e83672e6945c93f5abbf55a8e13b57d7715e980526cb3978f7e3d7bc9c8f4631b34467d7b5f75c14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
564e6d696f05c4b57a078995f53027cb

SHA1
944c620c3e6cd26dbd720ca701e4d42f836a80bb

SHA256
683c555aa51fe768498669a8c539888e0254d0c2fd3522ca14b3f170cc23b362

SHA512
0a1a0c147e3ab1998b0e32a14ef58f694fd43baafb125f58c16052f5eb0700acebc354983b241b56f18ff98e0fd5c8b1a3b78a77ab7fa6ebb791e4b313bce0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
10a5c3aebd0892949459f27e281f07a0

SHA1
ba9ffabdb0e35ad4aeb48e2ca876a4df0555f509

SHA256
e55b9995678881f9430b2659ccc17f54c3ccbacbeeda3e51c015a2c08d3a04d9

SHA512
a260b3ddd60745381a09410eb8ec8bdf4b31a6edf17cdf2b9788d5de67729150e206be44a44f3defce9640ae657643b5111db272d7c20f2b4742ddd55b481a20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1bfcbe02870d09b6cb4b38ab79f5bc0b

SHA1
2b2245484d31498481ee0025518209c0ec4140df

SHA256
9ac3e3b0a97ef0d1d3df8fdb4ef79acdd7889dacf01590a2c7888f5c7f4b2a9d

SHA512
f9487c9af251a3c0071062aa338d1c0d8a6940b09429e53f2ec840054b7c994d935160cdb14e286dfa7aebbd213f4218259466dc5d9041c0f180ff08460fcc00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
87dbc89c3892a906385cf9e4aa26dd90

SHA1
46f7b85e85f1cc6abbd43b39ee56cb40c3dff193

SHA256
c3261fe9a42477c25337904b1e3abaf26ce962c1385591b9d1c57c372b5f76c7

SHA512
5145c170f55eac86b8c9869f1f88aec1be21ebee3ae0837c8c639a03dd8a709d7b21a5087f3784e99d2298b206b7cd80d376aa56afc5b77624673b1ad9fee7e0

Download Submit