2fab92dee9d7ee800dba52b09756f7bf193dcb0db3d62e18644f3cb30fd3d50c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc691ef5d2352afa2a47d381f1709940_JaffaCakes118.html
Size

57KB
MD5

dc691ef5d2352afa2a47d381f1709940
SHA1

76cffc4e40fbbadcd25d56d39306a05ff89565e3
SHA256

2fab92dee9d7ee800dba52b09756f7bf193dcb0db3d62e18644f3cb30fd3d50c
SHA512

6994cc2dd011a0f13a09601e2503ca46d75d9d885322ee37c254170d5806b9164c46bb350393f957a95aba3f57abde87ad6aa0faa52e1d65f2a41078f06ee2d3
SSDEEP

1536:ijEQvK8OPHdsA1o2vgyHJv0owbd6zKD6CDK2RVroVqwpDK2RVy:ijnOPHdsR2vgyHJutDK2RVroVqwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
1556	msedge.exe
1556	msedge.exe
4692	identity_helper.exe
4692	identity_helper.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4376	1556	msedge.exe	83
PID 1556 wrote to memory of 4376	1556	msedge.exe	83
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3420	1556	msedge.exe	84
PID 1556 wrote to memory of 3996	1556	msedge.exe	85
PID 1556 wrote to memory of 3996	1556	msedge.exe	85
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86
PID 1556 wrote to memory of 5008	1556	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dc691ef5d2352afa2a47d381f1709940_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffb5b46f8,0x7ffffb5b4708,0x7ffffb5b4718
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1438202031006310278,7380402638781592217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
2318dd69fbaa65fa7bc1251521e8d122

SHA1
f6914d15ddf0e1b88292669416d2eed8d78cf5a0

SHA256
3273f3a569b9dd1657760ddbe71c62009b2d65057e7f80616b0b34e9d223d949

SHA512
97bdd42b557d6a1d7b9d1e15a0872fcc48f25423edfe983f5c4e7254ee922563ffdaa0e59519d46ee7f74f56463ed56c4ada888fa7a0d096aa21a2e2470f3be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6561d4d04917e006461bd99eb279b7d6

SHA1
70c6a780d88e1634d2b190ce116a295995cf4d1c

SHA256
597d30b4a93f5227c9cbf9379591e2313e2ee393f1556304696fbcc27d2e4f5b

SHA512
ed575ff40ca32ea69febb4a5113c1efe44877218b6b6fc624d6f5b32d7df711694fa3e5232d107fa2c3781694b179496eade3ddf2afa08cded870d8e6e808c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a8f3a0df8cc517abe8964ca774f49bc7

SHA1
b1de8a83637393e9f0d87962b9b3a17990eee659

SHA256
9a792ff0ed5d715912ec6e2285ec82b5cf29ba27289307ee8f03047bf10bf9f1

SHA512
7009e7d56bf98aac24d875dfe6b9a9c47448fa9da284b6ce5ec6fb1a1ab5e074bd05c5c12f94e8b428bf19f4549b88418a5de8822382ebd784ffa1ee374b6192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d7b797653381c83fed9dd3aede03499

SHA1
623425bff25770e3e152e8415492f218a6a85926

SHA256
7cadfdef47fceb22b25950fa90a1d9a1d131e509be98e8cb538d74881a217f51

SHA512
f64ac6fa618879c41b6e71c6031069b1527b6715e812e0c7de06969ce229aff324948ffe86fc397334e257d424f351c4966262e8642a7f4f493846853f8c71c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6e18ae5d0ca56c59d90fbdf5e2ebf27a

SHA1
8a4a53b100324800686466bc97f97eaea6a06bc6

SHA256
7a2635d13656b896b2949e566e8a225336ca22bcd905cfa8d7dda1326c08217c

SHA512
462f3df238bc5302b3db1cb2c3834690b8ad7a2b393bbef864a22793393b8315c951e7899c4dbcd211417d174ac86dc418077bde3aa5218d5baa8d18434f82e3

Download Submit