96da98a2674daf79cff4f02d11296f769ee9021196f249f014a6d83d7b87b7a9

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab757a998d6d9cab661f1e9110be733_JaffaCakes118.html
Size

18KB
MD5

eab757a998d6d9cab661f1e9110be733
SHA1

c2a28d47fdb0608e1c5bb4ccc00a0092eb0d4e69
SHA256

96da98a2674daf79cff4f02d11296f769ee9021196f249f014a6d83d7b87b7a9
SHA512

5030ab99ca4755f9aac9c66c8a9d29e71427ed41e83cbd8717bb0e6f2accb3f76b26631f5b8b9cf70861639c161320f627802dca9092cd36cae44ef8b90e047e
SSDEEP

384:PRRyqu6gcMQJOOp8Fqd1tC+QSS14C59aQPGcM9WW6QjO/z41210J6rehWI/7Fp2V:PRR7VgcMQJdp8Fqd1tYSS1558QP5M9Wj

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3968	msedge.exe
3968	msedge.exe
3700	identity_helper.exe
3700	identity_helper.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2764	3968	msedge.exe	81
PID 3968 wrote to memory of 2764	3968	msedge.exe	81
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 4224	3968	msedge.exe	82
PID 3968 wrote to memory of 3948	3968	msedge.exe	83
PID 3968 wrote to memory of 3948	3968	msedge.exe	83
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84
PID 3968 wrote to memory of 5092	3968	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eab757a998d6d9cab661f1e9110be733_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6b6646f8,0x7fff6b664708,0x7fff6b664718
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,14907556710487171767,16701338440644406687,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7fe08313-7dca-4f7e-85bb-c32d09939606.tmp

Filesize
1KB

MD5
5e28508a0782ddc9a13a65aaefe84f77

SHA1
0786e57faa7a0731d0530e7734260a4db5df7c22

SHA256
9ac8e8e589b89b68c6cd9d5f33c5e0ca5c22d7445f391c8d059fc7c2a6cbc8ec

SHA512
41408b92c4ea2a695eee6a3336f7de7f4eb9916dde2679fb439f243476811c49c965ede8ac3b1d90194a041d282eceaa5699c1bd3170f894f2cacd9790891def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
ad0fda55937906d380aa9a06cd1a55ac

SHA1
4ecb3e1fb8bc8dd529ba163a6f9a4d8b01193ba2

SHA256
773616fbe7be02e1e6d9f62f3b3b4d1dac4c6c919b2caff72f2b457422cc60ee

SHA512
e27b9b8a12b63820a4f2310d8be5d5562da64bad09c738d29fe41e66dc5e283f11b9ebb445df04f03fe5e3338ab3a739416200371fa14870e66004f2b3e2fa44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a2c8e2b92b01d8fadf22f90fccbe6ce2

SHA1
e329caa66571cc964c5576838c282ee3b7f0eeea

SHA256
53e9761540a5fbbce2d9c8013208c44a62e36927ad0e39ac14fb86fc18f36bf1

SHA512
8460964dd98a342839b2973fae47b219bd7d77025350e2cfd886f79e6d6302f0ef6735d062ed66f2962386b484b5d0915b2e597cbd7e519bb2c64dc58d47d99f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1b1a3c5363663916e885e2f98f499fa

SHA1
89ad8f88357f1c04c1dd20da196340451e8d7e05

SHA256
22f499effeed61d93fc8fdafe6a1fe7235380f7e0dbf58c7caba858ab974ad6a

SHA512
0d6a96d022388ea908baa5e5e1e517158511a66cfeb2fdce9454af585c3efb6965732e89698ca11120bfd207c61fe16e171271662b2be5040bc257c5ce99bd11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5ce37a9cce90c01e1b4be48f1c62b143

SHA1
c0cb9eaf31c3d6bd01c3cf5a15954fc40a6a8173

SHA256
3f184e3af2c804f207443037f2f305d23226a8e97b12cc3d176473bd3c2df7db

SHA512
f0dec1c91f68d6ac1494ed9c5af0347703047d94428998621ee4dc85fc18d0693ff4bc0172a28bccbec5dd9bba17eb01654c50709a34d37b384337902ab538d3

Download Submit