c86e62ae55a5180f0be72e2d6e6a96584f1fb57b61d7728146ad5d83101acbc4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0329647b3dbf1bdd8b947028be487426_JaffaCakes118.html
Size

67KB
MD5

0329647b3dbf1bdd8b947028be487426
SHA1

3549c9c73ac8fc3883be4a1753018db1c54ee5a8
SHA256

c86e62ae55a5180f0be72e2d6e6a96584f1fb57b61d7728146ad5d83101acbc4
SHA512

5596f1ecfcd67f4c9ac8af95b4aaf8c9695b4ee5c2c95e826354918ff334fd7f9cdb8af4c49fd4e15800c9ca41552aaa8d96b91773d41591f6e5f5d2751bb390
SSDEEP

768:BNk1lLthM5prTrnwfDlEb/+z2VQmqxRoMwffcH+wzDu8N:BNSRUpr3ml2h8T

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
3840	msedge.exe
3840	msedge.exe
2408	identity_helper.exe
2408	identity_helper.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3460	3840	msedge.exe	82
PID 3840 wrote to memory of 3460	3840	msedge.exe	82
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	83
PID 3840 wrote to memory of 2552	3840	msedge.exe	84
PID 3840 wrote to memory of 2552	3840	msedge.exe	84
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85
PID 3840 wrote to memory of 5008	3840	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0329647b3dbf1bdd8b947028be487426_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c6946f8,0x7ffc9c694708,0x7ffc9c694718
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,4886159857080825611,4076863338627905993,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
b8fba44bbc137abb0b29337c6acd1220

SHA1
facebd7436794ae407a1bbaa58163bf7b54acd0c

SHA256
a5f491879c20f384ceb28ef98d370d18f1cddf7d17f100bc8fb046633592ceca

SHA512
a59f15f000aff505f23352f7edd04dfe20aa24eab3ce42f3c446ee86ba8b7ad8fbabf41ea80d9d26d7735c32a508791053a6d3c3b0c3791d02ec051198c798c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4ccff23a84fb02307a6d3c1e5302f6e3

SHA1
731807bb5686b48e35e350730bf7fdda0bb8e2cb

SHA256
eeea51748b1cdc610d3bfca86af05551d47cc985aa5240f63a2a8ec27b1acef2

SHA512
7c4b5a61b76ab24018b58c5c34dbf07eb4d7995efb10b2353eaa78e970c62295fd92669c6443fb07a5679ad95ac3a779eeb30dff660a9e2c2cfb00f129e5ade8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b0226456e5fc23c80b7600523edeaadd

SHA1
31c1421ac071d3aafe12bb2f4730c9fea62f7606

SHA256
4cc5d8dbcb0b0c783fea0e374b10d4c23498334691cce3dc5b055467ab904a47

SHA512
f0c2d6c974c42039d2a0b25005fd37797fcf8d0a259f22a60b7400d2d4bb0b4e9b1685adeb489e6aaf74e3a07f8ef46af488cf0c9b62f3360af2fa72bcda96f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3de78a83ee4316f1112c18913c21a5b3

SHA1
f6018175576e5b61ea85c88c9bd563a9d005b637

SHA256
7aa95cda095835820b15368543d80e7838fb74170c5750059b3579ba5107c9bb

SHA512
edcd4d7a46fd67e52cf078a469b84ccd5579dd1a31d1a1cde3e7f9cc0db39f1d8e6281dc12f5f7065e4c9e0cffbce39b90b9c2a382dae56822864310a2c30308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f0e8d2ff8ac3623ac20dac179153fce2

SHA1
0d97ca8abbe2edfaa7bd09a1ccc4dbb2c2186d90

SHA256
9ac1875b8f0df96efe186b8f98de4610d24d9d3c14fb091b06b10a5cf5e5e544

SHA512
0e3d6ca56f2163da1e3536c4489f66b9a33e06a552bcc17a4d74d95bf985c8519858bb3ac031c6c5cb9d9de9a3f6aacbd9084e358abb67515b9a2bb26283299d

Download Submit