abcf36ed01475916d5464b942ca354138797c6f79f7b46f099876c5e087a6ecb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4061f8c49045cf4840a1f09fb4c66eb8_JaffaCakes118.html
Size

56KB
MD5

4061f8c49045cf4840a1f09fb4c66eb8
SHA1

a022e882a6f09ec4a0ed5e16db2fda3ccb05f5d4
SHA256

abcf36ed01475916d5464b942ca354138797c6f79f7b46f099876c5e087a6ecb
SHA512

57d57ea9ea2db6575a553e168e878e766605980ad5fcba552366b00d562b17d04a090cb07cda51dec4819a403d19450001388bfdb33cb4e38940ead984057328
SSDEEP

1536:gQZBCCOds0IxCaLYCcyXQ4MogbXr4j2QK8BBgG3Vm257b3WMnywPOXxOo/OrEip4:gk2G0IxOCcyXQ4MogbXr4j2QKqBgG3Vk

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
4048	msedge.exe
4048	msedge.exe
2208	identity_helper.exe
2208	identity_helper.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe
516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2224	4048	msedge.exe	83
PID 4048 wrote to memory of 2224	4048	msedge.exe	83
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 3468	4048	msedge.exe	84
PID 4048 wrote to memory of 1992	4048	msedge.exe	85
PID 4048 wrote to memory of 1992	4048	msedge.exe	85
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86
PID 4048 wrote to memory of 4696	4048	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4061f8c49045cf4840a1f09fb4c66eb8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff925da46f8,0x7ff925da4708,0x7ff925da4718
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11244141111705561410,10339831341851405434,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
215KB

MD5
1585c4c0ffdb55b2a4fdc0b0f5c317be

SHA1
aac0e0f12332063c75c690458b2cfe5acb800d0a

SHA256
18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5

SHA512
7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
b198f083fa9cccdf436f6f4a1e029da6

SHA1
ae317766884e008066e1b74654dd74bd9d90c2c7

SHA256
81c18337c69399ff6b0514aa354c0e24308f1a290c888f48dbc7320de09c52e0

SHA512
e1cf15e62e8a4b290c9093813313ad42e7eb11766ac5a99d468031923f47653a0fd28704ccf0ff9c09808c6c725dcaa9dd64e4a673561466a80731f3c79a84fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
129afaa85016dfa67936a0adb14f498b

SHA1
75cafd346bd6952836b0948352917a1d358d88b8

SHA256
04122e1f137f82afc4a97928dde74ad8320576bf89fa216a6c107f3bd9955cd8

SHA512
0b7a17d096184b04c25514ca84f54f447ef2d66e72cc0b1f48b4fbed0a0be0c9180e0d7d4c21006aaa7dbc6e94f2176bdf961aacc2dc817def21322f3e035e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
350353bc3efa632157878dc4ab975a30

SHA1
5952a76ed158d0087c6d90ca5a918f24a42f7dd2

SHA256
3bb2cbc94532752d71f2da941b9213c658cf9ad56db6a7753f1075ee8ebb4900

SHA512
6da8956a5ebe2f3edb26bb95c3e78fea8fe2a3766df84c7eff513047a3cac857b6af656b1645d9adb43cddd22c64ade7bb43aa0d4f092a0e41184bcdf2561aab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c525c22ed06d22a6514a327e9e5df567

SHA1
64100b2d729feda72b25d720ec6126f511a1aa6d

SHA256
5a373ab175d1796a471b17ee92d3c5d16e4103b87b5571dd1a73fd2b61995875

SHA512
9fcd67beed0d601b4114d6111adbbcee7e31e40d22dbb7e9e323e3a4603eb223bab13493d1c2ba3aabdce642750046b025dc2edff8b2e0fe491df6e4c503af30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ce1f01463e0e9e3f48b69437e51c93a0

SHA1
21bc87fa9b530d18e567a81a788957d331aac713

SHA256
a5b5e4b893f5e38ba0acfef04167580c5d4c66b070b3ecc6cca73d387725e203

SHA512
ce98ddf0c9a8a31685971999b952851b36ce2a4e554e37f408f2f46d5be289bf4f201c2161369241b44b88053986b8833d724fc9e3f609c65488ab371cd58236

Download Submit