f05cda4fb35109325c2ef8c3a25755a90b814448d50aef09cc1264e7b1160978

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

abfe665a8ef8036078a8c3ac708733a0_JaffaCakes118.html
Size

218KB
MD5

abfe665a8ef8036078a8c3ac708733a0
SHA1

aee7aca24cb6a6e041da0f22f1c4ebde4126b7da
SHA256

f05cda4fb35109325c2ef8c3a25755a90b814448d50aef09cc1264e7b1160978
SHA512

de8760642d4b73ee0ae4f884d083f76605a045741add69bf6c3ab1a2a14abfcfe400eb74fba07abb3d13706c9846412d935fae9c6cb2868ca6a05dc94a7d92f7
SSDEEP

3072:FTzooMwTiZqHSczyhMz7Ij8mA0/J71KKhJw68tq4m408tq4m4X6YhGHr7xsZ4vpb:e0iZomAqJAql7xsOH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
4160	msedge.exe
4160	msedge.exe
3588	identity_helper.exe
3588	identity_helper.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 3628	4160	msedge.exe	84
PID 4160 wrote to memory of 3628	4160	msedge.exe	84
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 4284	4160	msedge.exe	85
PID 4160 wrote to memory of 3056	4160	msedge.exe	86
PID 4160 wrote to memory of 3056	4160	msedge.exe	86
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87
PID 4160 wrote to memory of 3676	4160	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\abfe665a8ef8036078a8c3ac708733a0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbc5046f8,0x7fffbc504708,0x7fffbc504718
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,6410110268544380641,348742567919190235,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c4a6cd37ffea910664564bcb434654c5

SHA1
59c505bacb615b9ebefe8e706da5bd0578d7c786

SHA256
d06ac9123ccb0c87b3518fd5b0e44a79539345315c51a9140b90395875635eb2

SHA512
075c08d468af54aabbd8b6bb55b347824ec0926fe1b257223287add4134eb3d6e00069485b3ad109a507496d6ea6373279b99f546ef322160d93a4fa0e0d7042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
76a899e97bd81d56b0cc990b279e3e49

SHA1
e8cf4b394fb9eb2e578f8e8c164ae2ca6f68491c

SHA256
2abce4229ec96d009536fa6e7d933b0a44b0def4a215328a50c58e70dcd45a6a

SHA512
faf8788750d16bfcce34b6c704ee7181ebf4a0b8801e41704a6100dee47ce15d895dfec8793f6ac77c58b80c5cfb8de0c59b1d36bc61769d678ad2fba05da957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
23cf4b29b94d8860f239cd331458d5fe

SHA1
0381d546dc5c6c3c3caf95485ccda2bd7ca1383b

SHA256
076b2a75991d180178d290518c927e54add2e72556740ed47e99bc7bc0291f84

SHA512
79bf300c25a6844695d98111a41784b74e590c79e1a70a91d8b59a74a7adbf466a6cc04e188451edb7d8a385f24d729946221d1539f4471f160ac1822c1b723a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c874681eb314fe65095530ad1ec3e050

SHA1
fcc00d635d7ac214d3910bf920029a9f8e78a197

SHA256
dbe76bfe94010702ce348bbe3191ad58843772807ac03a1915b46f2b22d2d2fd

SHA512
13e25f117a5a6f035c8be48fd91af29832f2f422857cd1ebcee20187543defe1764d218f03913daa12348d7e75aebba3219799e3a84109a1c1d29ef440dfac38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583c1a.TMP

Filesize
537B

MD5
58e806f89ae31be1c4e0e029ed7a05a4

SHA1
0a99bb7675cd5f62b155b40e177f9297656b14e1

SHA256
069235a7b78312f34555d74c659f314a3257ba9ac9e4b161d63a497a2390ba53

SHA512
98d56a38610e57e39bdda373a45ecbae0bfdde465966cbb5a0d6187e32e61c14801b815134ca237a0259122c5b5f83b7bbddd1ea7c9438a6d90b5720b78d3231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a96e989e-ba9a-4a46-b861-332e9a96d07e.tmp

Filesize
7KB

MD5
c6836c02a810dc3ee1f46b0dc03e1afa

SHA1
99d4f16c9ed645c6f728650f07caabe8f5a75bab

SHA256
9ec5f4342fd0b4f90ba3f1220cb5c2147e3f56fd3222d6eb622f300e3defdbe3

SHA512
c0765f4b27c40d6bc6dac5d5323cb4e4b5adcc409a8631d6610fc850c2e523ba3a985cccd9f70b938f8b949f6de59a3afa4b4b72afbec9832f72388ede6d9410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f2a2380d-06c5-452b-b1b7-416d2a691dd0.tmp

Filesize
537B

MD5
301ec975fde049d5277630238961859c

SHA1
20a2220b41dda91c4da9fc9156fa004718883223

SHA256
720981bfab013fa3472a668c29c6814088bdf8d0b7e8cf022b167fcf4df705d2

SHA512
07f830cfeebd0c1049536523e23c9e9e7f4d2630768a679bbcdf7d34cb8b035d8faabc30b671d56c706e60924972304f87a2fceeeb306b0e56d89cdff3d6f8db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3a7abfbb4f8b5fc41d04eb9aa5a94c8b

SHA1
dcfa50ff0ca6a95fac870896488b1955334bc0bd

SHA256
37eab129b2aaaedc4ff91a314287c8fe4a16c3967b9047a413a6fdba8e110bde

SHA512
3d43461a797cd8500045cb4eae7551da78c82d5cce5f190b99dc89eb7ad27c37539df714df0d92e3fa3cead97609356a52b479c166e0e6b43c67d6c1eb353f22

Download Submit