0451d559454fa98acd4e5b19c80b5058e6100d19c4e9f5375cb984c79d20d4aa

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0de9692a512dad892206e8e9ce1abd7_JaffaCakes118.html
Size

97KB
MD5

d0de9692a512dad892206e8e9ce1abd7
SHA1

346b0ae4be2a0cc20e5add9c6e7adcf3c881d422
SHA256

0451d559454fa98acd4e5b19c80b5058e6100d19c4e9f5375cb984c79d20d4aa
SHA512

9bfa5a8eaab25b7f17609e79857b6643a6e5f3a167956cf180db1d4b6ff8da927d16de99e31365a871dfa570be112d5951ad4e81c981e2c076b13535a9814f78
SSDEEP

3072:nkpk/xOprQO++OMFzrPYTTo65Ht8aNjfROr2:nkpk/xOprQO+/5Ht8aNj1

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
29	sites.google.com
43	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4488	msedge.exe
4488	msedge.exe
2284	identity_helper.exe
2284	identity_helper.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 5012	4488	msedge.exe	83
PID 4488 wrote to memory of 5012	4488	msedge.exe	83
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 3816	4488	msedge.exe	84
PID 4488 wrote to memory of 4068	4488	msedge.exe	85
PID 4488 wrote to memory of 4068	4488	msedge.exe	85
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86
PID 4488 wrote to memory of 5000	4488	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d0de9692a512dad892206e8e9ce1abd7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeda446f8,0x7fffeda44708,0x7fffeda44718
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,8455260190767182540,12652820738150898890,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
15f3ec44535964e9dfefb56cb04ce6e3

SHA1
c0b5bd184789bae256cf804ff3ea532f16c2dc3f

SHA256
e40238bede3e4ddb621ccec8feea1bc687c8f39399a54c695ab6c05a5581054d

SHA512
532613c9ea71add78cfc19c3487087da86637f27b289b5b866006e1170be03c286cf27ef4a2628e0dfdc745d12f7929bc3b247f9c415a2fc6c489ea7eacd3404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c14489a3dfbebe90d81b46d6b5f7980e

SHA1
7f098a7b522c5bb692de2f3678bee086308fe7fa

SHA256
a64c3febf688581f86f732a3bd4317cbf8d039e13756efad8d71680f422aed98

SHA512
bc285dc48de93d070b143ec280b6a27e0dedd139f0ae0143261fc003cd44f8030090815a94b80f4609d66c6d391b4db17a173bcb6427ac57f6bddc53e995bb99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d09c1023887aead1d554e867f6b56148

SHA1
c905410b3d8ce753cf06a26ec24b990e643f666a

SHA256
19529f0155863ce87eab65a93073c7e7a154c35d29e994058bbad1e8ddc160ff

SHA512
9fd781035b1b03c833545aa7155ea391fed3db4dae64eb0318e34ed26af5d460868d8727b55f308d6d96e4df2ddfae9fa2d10503d785d3693cd2ed009bda2c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e7a29f9ac310dcfc86a530ac27278220

SHA1
b1a28dc82669185645e50217f6ed96a68e5af547

SHA256
a57093db42e7d2f1cbd737af2b280f7a7bb3906db19758a8ce4d2cc13cbf837b

SHA512
22ac1bdb9691127c6855b067e168df603dab27f7f86edf2bda2cc3d57febd344d13df25711edfdf23a763a7902d3fdd13b1160cc736950f1ef8d59852e707aad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0f3f750e5073449d947427b0de43872c

SHA1
d332bf8f0c60071938c40b4afdaa327ef4d35c70

SHA256
4059bcd47d86032b2eacfc994fb0690cac41a3fbd068816420560f1a519af5a9

SHA512
62fb1931198a8f02144a86313b9b8b171648d7f1404d1237533d0604a4b2036f6320663b12eecb3376447bbc33bd8b6de582f2b332f76040d1a6be63e8007179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c2e049698346c50efe6cb9a9c34a4e3

SHA1
64a254b2c6ad23028eb3dcbd5dc7b8cf13e66ee3

SHA256
0e3b41594a347d8009190d4fc518d834f999a86c51ef4608a0a12fe6dcfee1b1

SHA512
62fa192d66c7b081b66ac72c256f7fee24dd0f571eadc15e937d0788629983c386ce67e0463555800720046acc1d6e9fade4c5f5e0648be280c4272f75948ab6

Download Submit