417ae6fe54c0ff20dfbd61301847583dc846ff0f9c38bdf83586e8c265251c09

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa4e79657485c7bf0fd26650aefb697a_JaffaCakes118.html
Size

57KB
MD5

fa4e79657485c7bf0fd26650aefb697a
SHA1

8f8f044b72a634e98d5a0e8432e791f8e7c8ec41
SHA256

417ae6fe54c0ff20dfbd61301847583dc846ff0f9c38bdf83586e8c265251c09
SHA512

693d2f267ea09ce186a5b9a5c2df8ac65a68c1e021b7ce72deab903e9979dd57ffab060a3fe7df1a411ddb8ce77e2e039d3abbda558bd4d2c76d3aba96b86f5e
SSDEEP

1536:gQZBCCOd40IxC54lPTVS550aV7bIxDO2+pr8cBg82tIUz6gXRtTYfXlvaV98KGwl:gk2m0Ix5PTVS550aV7bIxDO2+pr8cBgB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
3036	msedge.exe
3036	msedge.exe
1652	identity_helper.exe
1652	identity_helper.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2144	3036	msedge.exe	84
PID 3036 wrote to memory of 2144	3036	msedge.exe	84
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1908	3036	msedge.exe	85
PID 3036 wrote to memory of 1128	3036	msedge.exe	86
PID 3036 wrote to memory of 1128	3036	msedge.exe	86
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87
PID 3036 wrote to memory of 1192	3036	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fa4e79657485c7bf0fd26650aefb697a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3dd746f8,0x7fff3dd74708,0x7fff3dd74718
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6607738126589116703,7936939816618735729,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
135031337283e6a1cc6fcf03989f6e22

SHA1
7edd923a054393304e3c67540f1381ec154e04bb

SHA256
9d1bd3b74e1fd2f212a349364a1e5d30ca5ef796ba22b98b48e2376558f693d4

SHA512
14210b1abaa517d5f0abc171dee3a97e43f59da0afe89ac2a1bfa766684de13a1d23c0f3c2486493666ee588bf005687a5c3dd07219c9de0837ec183960d59b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3fe9adc5f8a542682527ccfc04f4329e

SHA1
d47ba911880c8e2e012eadf0f41d9c459330608d

SHA256
a42caf6c4a690c16fbfd47d1ec052839e4f97660958692984dec17fa7d699700

SHA512
a068bc532246873d38b4fbda526f1c357c74fe64249a18691c83d3c63018df944f1878f9b0d3cf919e105e882807274e2f8e842218c4be7af433860b14c49b84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9327c6d726c601101508e58db20be1dc

SHA1
2e7c98018b61945de45d44ac38622a6555d4b095

SHA256
1347e83b4455d815ebd7ea463a5e06ab61074d9b53595408641bfb4fa08ece48

SHA512
e95fc6fa61ac72e8c6e430c13d96ace7bfaab49fe2d6438c8e0169b338938c8d9928ac689c8ea688b3dd4467967c50175d0f2842a3827db0b68f639180d7fca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea94984a9d695e0319b32a8871bd1c88

SHA1
a255f597f9e8a63b23d5d775b5242b6d858201b5

SHA256
46fb020af7d7193b541cf9bcab00461774ab5538614350072a695b4aec044e71

SHA512
ec47e5d367104d1493d912dce74ce80612b5838fe834567235db0ba8e2dba0856d90d27807694ffa8a70a22119e8506577c0cd0f1c148ba2be4e4d1488fd0699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1d4b0c0effabca337f9da305609c8a11

SHA1
2f869669cea01f22318c36d20fb1cfc7e529f6df

SHA256
7fb3290596de46ee92b7d66cf7f2c190318b5f6ed3553c108e15f1b4ed57962d

SHA512
88339ffe947be1f6cab3922e1d444ec6f1c823b5c612836f5382b3f7168e0349ebef66d982e14a4b7f77bfd79c034ddcb22e66c4020e5718af17f4710e315d1c

Download Submit