45f9f00d70f55e9d8fc96378ea457bc529ad1129b59438e08f25ba5e15e75c18

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd74e7a30275696f77dd35b33074ab19_JaffaCakes118.html
Size

14KB
MD5

fd74e7a30275696f77dd35b33074ab19
SHA1

846618992dfe655bd09e4cafd463c764f57ab882
SHA256

45f9f00d70f55e9d8fc96378ea457bc529ad1129b59438e08f25ba5e15e75c18
SHA512

711688ee0a2280ae44fdcc55bb9fa29aa64527bf8ef37b0098976c9ef1057f04b8b841867a2a8167dfc678d01eec4516899dc79d4bdc6b670eebff3fa89e258c
SSDEEP

192:Ycvfhr5jceMnA/1/uKGRQBORE9Lhze1ajR1wU7RF46atZIx8ISI+j3X1NZqu4oEG:DHrcLtZZmITqBoEl2yPAeCKH2V

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
4320	msedge.exe
4320	msedge.exe
3460	identity_helper.exe
3460	identity_helper.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 3660	4320	msedge.exe	82
PID 4320 wrote to memory of 3660	4320	msedge.exe	82
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1132	4320	msedge.exe	83
PID 4320 wrote to memory of 1012	4320	msedge.exe	84
PID 4320 wrote to memory of 1012	4320	msedge.exe	84
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85
PID 4320 wrote to memory of 2792	4320	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fd74e7a30275696f77dd35b33074ab19_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8078f46f8,0x7ff8078f4708,0x7ff8078f4718
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7589970892806225850,11852750277651047039,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
f0d5564db3e477e989571166b3b6ce8c

SHA1
c8a142b518a6ad6cdc04437daffe68c56e455f2d

SHA256
a5ee604b7fe65e682a180fef7bb7cd41e2fc6cf2e697b10f205326cd5f856490

SHA512
3680675c0226767f66cb25e4e8defb0c52c3e030f862d64b1981940b94ed0e9eb6ea00189528f755a77868c25a9cdbc7d79536d3002bbedf95163b9f42e55e0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e493ef5e045379227af845019f35c1e7

SHA1
08ef6162f07cfc943324efe6a27e7ffb1f9b2a1e

SHA256
a5beb9ff49b9c62d23fcdac5bce6b5f2f0a011a7416eb0ebd5f92a8bcae77864

SHA512
a9957bb7d5dbb61048f53bd4052560778bc721dd481d5638c3300bd2ea81d7cf156d46bab8eee25f292078cae05c7a9951a44463aff215dc6bd7a65d60355e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fca27a4f7f2846a266855856f2e34461

SHA1
9a15eff379b36ed9ea25072bdeac2fb9018424f5

SHA256
8482d0db7b5f30d7f9bc0d321e7b5610beab8a4aa4e045aeee8f01c9e68e73e9

SHA512
5bec7750de8629ec92404a635425c1a86d1041191631998025e497b754b51f5805b32a214aa717d99e9539639efa341ebf686d28d1e5d08c26dce6984ea45c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1043bf8633ec0cd50f43c84d7f5859d

SHA1
91d4b6380a26af8d827b00dad509464c9cd13f22

SHA256
f24fc372aeacd74116ace1abc93e8a1826c81946fbab79d4409c1eb8dac846a3

SHA512
a75da22e26796b34636aa886dbc5ee3b13d065e7997fd0ea5c4f637f4368a67ee01cd7e3e27e72eb2e550ec7798d6cece933a4660eeb19ae6cc18eedb0c929f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f577e5b773563588879bcb5aab49783

SHA1
91ae01795aa7870696d789b15219777becfccfbb

SHA256
ee2e164735d7967e7ef42eb2853451802a6b3749edf5adbf8446735c2c32bf22

SHA512
d44185a2d12ca2076bcf95df90b2ff1932276a74171039849cdcc634895969a00b5e91f1552c223651de50cf07baf432253b0dd980c01c497d1fbe9cc3144564

Download Submit