cacad7352b9ba23a44c34c7d319291002496860acaac3fab025899a2d183b09b

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8504cfbc9b67bc2fea69222182c6441_JaffaCakes118.html
Size

104KB
MD5

c8504cfbc9b67bc2fea69222182c6441
SHA1

5a1153f434ced14cdbcfc11e3debfd6d697a98f4
SHA256

cacad7352b9ba23a44c34c7d319291002496860acaac3fab025899a2d183b09b
SHA512

58630fe6699afb1d6e7f0fbc08a5f854c3973e6ab68c2c7b6ab9cc4bd2e4fcb79915b36bb5a869e721de93066e70b9bd9ee4e468e0de7220fd4d49ee774ea8f3
SSDEEP

3072:CQP4Bub1DGRXLc6cIc+cG2fQbnu16iKA/cpN:CQP114

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
2032	msedge.exe
2032	msedge.exe
1704	identity_helper.exe
1704	identity_helper.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2888	2032	msedge.exe	86
PID 2032 wrote to memory of 2888	2032	msedge.exe	86
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 4960	2032	msedge.exe	87
PID 2032 wrote to memory of 1612	2032	msedge.exe	88
PID 2032 wrote to memory of 1612	2032	msedge.exe	88
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89
PID 2032 wrote to memory of 3324	2032	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8504cfbc9b67bc2fea69222182c6441_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdcac46f8,0x7fffdcac4708,0x7fffdcac4718
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4873998745823993204,8628197860453265941,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3460 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
9f440f9a5ea4105f6de750fddb34cc77

SHA1
3933b5605d7905fe925cdcd04e09f4aa8f31d1d8

SHA256
a24cf9a86362429d9b2181cd2f057a2641fbb48597c633eaa737ed104f8c3c39

SHA512
8a784dc7d2dc81fb29f9ec127db9d9d5231f84fdae6526fe0e1befca50953be94dacc94603265570b7e924dbf5ae932f6f8cfe232fd86c5224b4682bdf3eda3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
66815562961b47dbf58d14ee39be03cd

SHA1
89bacf11a58391fd4da7a56fb3829237f7ef6a97

SHA256
60d5b1bb3e0a1cc28c931667ea114108aec7ac2ab3c9910fc7f8d0db28d7c887

SHA512
cc818c47a37853d042d9af1ac2bed0061c83ab5187020e6438d5eb4d46cd051d6584e97795a8629a4f89a248e7629f5461391b4e2c2dd199628bcb27b2f8a5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
076194f0d87be97818046d0783f15e1d

SHA1
d4eb3384dbceac8d70edd14113789523b3b50bfe

SHA256
a03b37da6d044f32bf66be4a1925f8061afdd07264614f217aa663dca05ad145

SHA512
addbd35cce6ec3cdd183dd352876e715ebe8c157005b81504113b2390cceba1951789cbb69c4c856a6fa926382b2885ed39615b082a607fc2bad1f689a830427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b632e71b5f5e2904651e2dbb759cb29c

SHA1
46b6ef88e24216cc3bb9433c8e5e785b6e00dbb5

SHA256
3f66fc6c9452a300920b13a1899780c5219a6673d77bf6db90c13ffdfa56c40e

SHA512
fc90c68a6f2387ffe3edcdce806965a53f1eb618427b287d0f0f0518c728088fda46ddd25a74a04ba38304022c1a54ead4bc052f052f7462e165c7d8eb98ff13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fdf618b945e6f2f9035b84eae23e569e

SHA1
fffbcd63bfe9454df504246f1cc4574ce5505ccc

SHA256
a9649d488f64596624699bc677106a3d5b33d8665d358d7bfc3ca3090d349531

SHA512
6c6bc55931f87ce68d653f9d85109ecc4d7b5c6960e13fa7ef3042cda004a7afdaf9c1d7bcd8e6bc5c1bb31677f044b13c3fac5bca9e637e24f3805e2e9793c4

Download Submit