445273a46a628e3e41d2c6ba9c71d6824619a3b6d33b66c189a938f62688a9a2

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac22d35ff59c30dc050ea27ccb931cc_JaffaCakes118.html
Size

57KB
MD5

eac22d35ff59c30dc050ea27ccb931cc
SHA1

d57156cf9f6e8f63159e3ff9189fd3f8ab0f5fd6
SHA256

445273a46a628e3e41d2c6ba9c71d6824619a3b6d33b66c189a938f62688a9a2
SHA512

2098959284f7d466e628835c46f3dafd8aec62b19f1a639b841acc4ebcbbb794861e9d370ac9e1c0104dec8d5d2662691ca4322aa0fca195ef73bc578994d31b
SSDEEP

1536:gQZBCCOd10IxCXZXlfqfufxfSfSf5fBftfUfbf3ftfXfZfOfIf9fJfbfdf7fdfSl:gk2D0IxaSWZaKhJFMDvV/RWgFBz1D1ql

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
1280	msedge.exe
1280	msedge.exe
3156	identity_helper.exe
3156	identity_helper.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2208	1280	msedge.exe	82
PID 1280 wrote to memory of 2208	1280	msedge.exe	82
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4656	1280	msedge.exe	83
PID 1280 wrote to memory of 4384	1280	msedge.exe	84
PID 1280 wrote to memory of 4384	1280	msedge.exe	84
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85
PID 1280 wrote to memory of 4168	1280	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac22d35ff59c30dc050ea27ccb931cc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd860746f8,0x7ffd86074708,0x7ffd86074718
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,15971044599033177816,2124625384587979011,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
246326d6e1a91baebf37395726888d6c

SHA1
e5bf6b4b56218f8e3cb4b0fcdea307330ea8fed3

SHA256
5a6e0afc0d615e0c9c88ca783a44947293af11ef9e96406a42e02f154ed8763c

SHA512
a80619616f9597b4f301bbf685dd82da12b438981982f9e2fa506112890e3c2d9b0acbd91eb7f81d2596b18106ddf0e392ae1915f204208562212716b7187123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d37ccd6c65c6ef91b5279af643c0ec40

SHA1
1a55a38b0bff2eeb484c70a9fd55ff54e9f7a550

SHA256
1bbf5fba683767acaf83da8f3ed1e6a7872c4d928872a96a015f0c575c62ff94

SHA512
a450d33dfba87e01cf6594c59ee5d340fb83ca7d0c86cd48e3e7c2d6be2261b06b05987460fddfd2e74a9c7d9c3244b00c7f86021ed908a1027a44892ee7c471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6bd0f70c9ddc9d794a5d9f4c48fdec0a

SHA1
9a0c187de6354d80da848dbb36b43e0242db2b12

SHA256
a10de824b20e87f765a96ed661b1056759393817e34a90571a670287b9e37dd8

SHA512
2afc1778a98bba80f55bb69e078f7246c2e4c02cbf623c9cbecd4d25a5cf171b8447d7821df0566bd886354d9a92896bf57652c40caaebb9076dccfcc857474e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec07809f66a7736c640504a17405e951

SHA1
849b74778303eabf85e72bd6a9e3b947667f9bf7

SHA256
bca942283f9cc384f1ab12e926ce61c46afcf9ad8ebffa3b8a74d59e7198bde8

SHA512
9189ed16e2d681d2d58c41ca23aa283aa5be5c46bac194c8bac7b1bd79d497e0fa03be075fd59a3ddad6627fd538aa70a0bfb2d2f783cae09ab1095b285e8f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c243edf92256a8d3c552cee0340685d

SHA1
cb520f604db50722a7d4ab52cce70c0ffaa1fe96

SHA256
37c92bb20c4291f566f64e24929a52e25763e5083062993f2d7113ef4ddc00b3

SHA512
1835fb4a56433b22a02420be5b5f4f4ef4863255040e496db02ab3f931b2c495dfa8dd1c4d6b2b5d9905844014f66ebcf6bba9c3a796372a6884b3a97894056c

Download Submit