4d1873787d17e52c4daf32917d2ae643064e92a95ff31a149d944ec3a02ff595

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

435f3b89a35fb244054f45c636c0132c_JaffaCakes118.html
Size

110KB
MD5

435f3b89a35fb244054f45c636c0132c
SHA1

fcebd4881bddd3e912e10e4685312206a75a3fec
SHA256

4d1873787d17e52c4daf32917d2ae643064e92a95ff31a149d944ec3a02ff595
SHA512

1c5a4e916cbbcf732ddab29517cda0bd416f6f9bba7d59218cd4bd10a80364d14c99752ff218238cdb9b96f8f44ea0884f10915ebd53affd1f055ea1ea9ec44f
SSDEEP

3072:x3kAzB4armwQULt+qN8poQItytVJlp8o+Xg9eUQtWuV2OZGj5oT/QiJhKtbchu7c:5zB4armwQULt+Q8poQItytVrpJ+Xg9e7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
872	msedge.exe
872	msedge.exe
1820	identity_helper.exe
1820	identity_helper.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1308	872	msedge.exe	84
PID 872 wrote to memory of 1308	872	msedge.exe	84
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 948	872	msedge.exe	85
PID 872 wrote to memory of 1152	872	msedge.exe	86
PID 872 wrote to memory of 1152	872	msedge.exe	86
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87
PID 872 wrote to memory of 4928	872	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\435f3b89a35fb244054f45c636c0132c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd317946f8,0x7ffd31794708,0x7ffd31794718
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11939741086325499405,10825853697781604220,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
099caef8fac269a26c761cf06a66a92a

SHA1
2ce5d722ca31b905fb7505131876528d730da927

SHA256
0ef5b66a24b9b565ef7b2b837da7584fbe6a3293a3cbb66280f0a1b5ce2313d5

SHA512
1905c0dcc76b2de428f958e3d8fc5fd1587146f1088b5b81c52849c6bf6d16c5cdfdb103751bc9b0db07ebd15112cf2d001fdfc171a6facd2fd6c960bc50c490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8b585824b63619e23a72a9584603758

SHA1
bd25f2b0efa18f30f47820c8676fd800ea369fbc

SHA256
d9677ec2e38ba61ce8fc5f4f661894439ca37da0692f89c9774d271217d314d6

SHA512
9cabe1513b8bd308f301b8e87ec8b302f267d92c5229e420eee254be86a64f3fc9213c2a1fe652c90242811a488357e2469e89f418f2685deb41758d66bc6805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f939cc20c1695c32005f3e7cdae1589e

SHA1
22e990a9e6b7c07ebd055ecc30e451e6e26a5596

SHA256
6e55dbe69e48d22fde98c24882924d46350730b2fc99b288ae2980ea1d588864

SHA512
db0910ca95c7471ca5bcb56d28470fd404bb2e01d3609810028e751e875bbc5c7340e83515a42059647896b76e17cfa7c8020e0063d4a355c3715ce775be79a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0cc15a8bc931d203222c06c747a9460e

SHA1
582f1dffb0e4c0e89ab5f335ed15213f414edae5

SHA256
adf245cda5a1ae0d91ad44551f88c2e5a3187c44c4f4a9d5b97a9b5de9981bb6

SHA512
c085ec5e98b685a4ecb77a6a61f58797345b5dfe42325bbd67618106c7adbb067034ccd3ec349de7917385303d0c052010af51a52bb33edc45e580c8ad13c058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e5201ba55ecbcb8927221b2db9676888

SHA1
e0c399a8af8c6edaeb6227df4889023f5b51eb97

SHA256
6342e43afe9233819c45c803e603b3894d73a23068eac6f5a69c34ba3743bd32

SHA512
dc295c04007b6fae03d8e3b5bdb97cb81dafb2f0d670dfa6d71a44a2914caaf61560d4f2e8629ed5ffd34579b0747e59c185171efbf6e785c248bde9ce67fd87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5818f2.TMP

Filesize
203B

MD5
3fc3113aa04a744f2bee856c07b12c49

SHA1
d2409a1c4bebb745052e5343114192da08dc7438

SHA256
8853068e6a896ea0a6dcca7c567c392ee9d31b910fffd1754dfbccaa4e8f1bb7

SHA512
c70f1cca7208d3c6dd155369582b24a708bff0e5d661212e2294350c71a10ebd75e435247bdec4139aa12d2df86303e566e4d178dac1b8db74a1a03ca4775653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
53fdd4b865bc0ff36e3755e0ae557512

SHA1
5ac58e08c6669c13bdaf95ea3f15510133484739

SHA256
f573c7dbb35d994c10aded6cc7d5729f632824d4210aacf666bae37f1d52536a

SHA512
957b07cdc116455cf07d1e2762b5a2422b73fa9a151ba33827259707396bbc3362f189d5ac2715df8a872fa419cdbd8d077d7fda15bcd005914501e44ef91f4e

Download Submit