89914a053986e936d4785493699304b3875d229f84e1821734445725b743f1ce

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6335ca663ecc2f8224ca652cbe5f3a74_JaffaCakes118.html
Size

150KB
MD5

6335ca663ecc2f8224ca652cbe5f3a74
SHA1

869fae57a4d990d227d0571020b0e3791f356d1f
SHA256

89914a053986e936d4785493699304b3875d229f84e1821734445725b743f1ce
SHA512

7616ec60c521e8f34c578abaa5a85d91b4c99913d1989b4269b17dbcd0660412548f5d5bb404775f381ebd2fd1162442d4f2845a9f84b030384b192ff2cebc74
SSDEEP

3072:LmcDSHzQbSw5krCO0/V/8rnOL55ShutT0FZ4I3n3w38fU7ienQpfQLPya+KIstwm:ycGHzg5krCO0/V/8rnOL55ShutTa3ngN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
644	msedge.exe
644	msedge.exe
732	identity_helper.exe
732	identity_helper.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4668	644	msedge.exe	83
PID 644 wrote to memory of 4668	644	msedge.exe	83
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4844	644	msedge.exe	84
PID 644 wrote to memory of 4872	644	msedge.exe	85
PID 644 wrote to memory of 4872	644	msedge.exe	85
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86
PID 644 wrote to memory of 2576	644	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6335ca663ecc2f8224ca652cbe5f3a74_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6df146f8,0x7ffb6df14708,0x7ffb6df14718
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5472 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4182277018823697142,13939514086522599358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3b695ace71951cee55efe9c2d7a4805a

SHA1
4fde903630d80ef3ca081758e0b5e2b4b463288f

SHA256
d066425ecea841ba45e9a6564ec933d9161aaf564a4ad81d7b87bb2d87db555b

SHA512
da360df73c36668bdf7dec38d9316f9027669e439ef8548125a6ef9ff67bbf659812aebe7dd9ae8414cde05a595f370a48ba2e62f8d3492f1084581e3721ee33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc7999169c81bd044b2d1d60d724bde8

SHA1
802c963091138e8f86c447d449b52530f8ec12de

SHA256
fe04df277e97d3cd7db4d2728461427cd9e80d39d208b897271cbd4f61513fb0

SHA512
573c94cc6b9bb371224e1eabd447b522a53df673304d0202c1ea735f4f2f526f02fa88c5b11333736aae65cc1de81d25e0314ab2b3e8c2c742bf2c7f017561d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc55f0b4bc0e6528acd73e31b46b5258

SHA1
bd27e7e6ebc080fe25e55f9ed28331a1d99e1dd0

SHA256
4cbb3367286cd4f9bc2673039f7f84030d01dbe900a13d719272a5b2241d8a89

SHA512
285a589edaec2c4f58173f33224161e48417bfba92f90f47c94de575b1aa5c7a61a54be099225d741d291151d74f90f4afef84533e0d1b0825f780627f223658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92bdebe665e16b6805c824dd73fb4042

SHA1
581087244b6f43343b6d3780870a6b59977cf8f6

SHA256
0e6f655ace39ed2dec7daf1512fbdac8839124d10b7dfb292292a71b5e099936

SHA512
ba2f74b47c0d883234a25b339b51ba3524d2b63f20c8b8c5f9323ba76393ccd4f6a8784451f03cb4c69643ec60c465c520f5e8a148bdcba6b5a93cc398bd7828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
413a15bf17486bb07e52d7ad7749dbfd

SHA1
819717672cc73dd257c2d9a0007e27e43fc61a93

SHA256
564b3f90de912a42e747b68d526a79e4a97b45ce150cd14471b0be1b7f5e6ebf

SHA512
86340aa23b6e5ca9c0c82b20bf35ba3eb783a072de56e1eaa74d8c4b107af9614a3de5d7156b71853eca71c853286f3e7aead45374360d132c910622d64b5c27

Download Submit