a5c1c0dded21bf1df136d6c83cd4c7f069fb01632e76361e1564d19accea6feb

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ca076a69daf087e43c1db8236b18fa1_JaffaCakes118.html
Size

56KB
MD5

3ca076a69daf087e43c1db8236b18fa1
SHA1

1554f23d201f9b242e8f88a11b6ed7691395b911
SHA256

a5c1c0dded21bf1df136d6c83cd4c7f069fb01632e76361e1564d19accea6feb
SHA512

02ae8d7607112e79c1eee9590be42d727ec5c270cc5cab5a4c281153a8c7e3d77db2ae393d2d12be29210a85b6ec8850411132125187da0a518298ce9834fb01
SSDEEP

1536:gQZBCCOdbl0IxCABny3fVf8fMfdfIfHfvf1fIf8fJfhfJf5f8fcfTfWfX8f1fzfD:gk2T0Ixs9EkVQ/HdwUB5hRE07OE9LP9Z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
3648	msedge.exe
3648	msedge.exe
3868	identity_helper.exe
3868	identity_helper.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4480	3648	msedge.exe	83
PID 3648 wrote to memory of 4480	3648	msedge.exe	83
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4336	3648	msedge.exe	85
PID 3648 wrote to memory of 4400	3648	msedge.exe	86
PID 3648 wrote to memory of 4400	3648	msedge.exe	86
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87
PID 3648 wrote to memory of 3380	3648	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ca076a69daf087e43c1db8236b18fa1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd575346f8,0x7ffd57534708,0x7ffd57534718
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7425260720721102011,14628338042237489297,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
215KB

MD5
1585c4c0ffdb55b2a4fdc0b0f5c317be

SHA1
aac0e0f12332063c75c690458b2cfe5acb800d0a

SHA256
18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5

SHA512
7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
8fb2cb4cbfe861fa2d310b028267d9ca

SHA1
ed23bad0cca053165e3d04ed0b0dff65138d1ea9

SHA256
0065d660ce9af4d4c535e5f722815ad21757fa6cceb929901caeafb01ad340b5

SHA512
cdc3b072bf239ff41577a33e38a38d572552536dcad3e9b79b9a81b7d420c836cfafaaf9c63a59e530cc88e6c5b51ef7c3716698854edf89735c6e8e5fe90e25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bd49cdbf2546418ae0db0cefe323c696

SHA1
d52f3a94dd4f272003f77c201cc012a6365dba12

SHA256
23cc69196d8c2e28f070a202085c81a1b0ee9ee400b32eebfd68194c7a5e51bd

SHA512
fc9a5261cba98d9aaacacb4d4fe13c728d23076480dfe73dc66055f92bc27b8e4754664ec701dc6acdb29843a300908261250273524a2e89e42f3e18505fb005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9337134088055d8d2b96e4bcfcb4b743

SHA1
7ea73fe62d7ecee168aee3188fa55edea2f23cb4

SHA256
9436a60a0994f614d33fa96a3d0bc85ce7aaa83f6f388e95562f61df5cf41197

SHA512
1924118c36205d4b35f7082a38ac5d145d9375762daebdbfb459239e76476d26d8dbe2ee9ca6bf92dbdfe251b5584d945220fa3d3103440fee674d6a3b20739c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f766a55f44c3eb507e913b03dc1e579

SHA1
209e2581355b05b5078af3688f0a35527694cf8e

SHA256
54f950b62feb9f422777efd3f5893211466be6a53c17303d75c6422f6b92ab1f

SHA512
074a23af685a4eee745076757cdf8b88c3c39d103f6a80716cc0e4b21b23884b26282f1abf7878f9a16a25a82c52c49f8dcc8f9a5d4dc8f25ed8b61606475b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8b0f3b04aa649f5eef558eaee81de6c3

SHA1
cd7adb96dc8f33e20fb24c32f2f972255102e6f0

SHA256
bf4697cf2d4818b893fa39c343454a6b808715b36e1d3decaa4b05fea2b9e788

SHA512
0cf23e38747c6202bedf653b411dfa045974451ee30d7d7829309bcafcc67232bdfcda8d0d14aba89686c19ff43f13c70b6bd2905cb1f15c78c7dc228650ac8a

Download Submit