b9fb8868cceb45e7d029a98c5415b193fa22d3f54e6f3a56f7d0b2a6c579b41f

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf47424b65ce68e032a98670e1dea93f_JaffaCakes118.html
Size

20KB
MD5

bf47424b65ce68e032a98670e1dea93f
SHA1

edaedb6075de44833eb8788499cf5c3c3a70548f
SHA256

b9fb8868cceb45e7d029a98c5415b193fa22d3f54e6f3a56f7d0b2a6c579b41f
SHA512

bca71d96a1baa62908374dbf6f5a222f228ac434a6931aca9a893e729d633bb6746cf2eb4fd91d4f8da74235324affee0de300f1583c16e3230fa228425edf35
SSDEEP

384:BfjXbAS49MGni9hM9G0uM6LS/kLZNLjoHcQnfws+QK:BbM5Fi7MGzWw

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
25	https://jira.ops.aol.com/secure/attachment/688199/failwhale.html

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2400	msedge.exe
2400	msedge.exe
1864	identity_helper.exe
1864	identity_helper.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 3368	2400	msedge.exe	82
PID 2400 wrote to memory of 3368	2400	msedge.exe	82
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2948	2400	msedge.exe	83
PID 2400 wrote to memory of 2328	2400	msedge.exe	84
PID 2400 wrote to memory of 2328	2400	msedge.exe	84
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85
PID 2400 wrote to memory of 1300	2400	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\bf47424b65ce68e032a98670e1dea93f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd480846f8,0x7ffd48084708,0x7ffd48084718
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2216 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10835702590693157884,3394475195278712906,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3568 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6483782cd5d6f791fee4adefcb5f2083

SHA1
0c9780997a312a52823104001ec7f76b8eea9064

SHA256
ea688848f714066fd58506891c2b7b2c223e85015202e0f539958df0fc68028c

SHA512
25c23a4a22b659d820727134f8fb1ca8f8e485453066595551928ebe3380118d835ac3e45d3daa93f40af606ef22423de9d5d6757709d100be38d5ffbb718dfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
dab7bf801b6e40a08104df5fd2075f2a

SHA1
c570089e680afb6d5b6fe411e92d66e27bc64740

SHA256
b8651e5992ffe5d8bf32a7d9ffb39db6e4cce6117025360178f92d39b6649ee3

SHA512
4064f451f0df3cc0dc7cb07ca9ec8f1915d1f3ae098fd2c637775a6a80459260444c21b928beaf4f668e8e68160b69aa226388b42c3cbf6865014c40979c50c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ad026a4627df0d583a3eb075882a392c

SHA1
38f663b2a90a8c7362f4b7cc12415a87c319c4ef

SHA256
311f692fe8a2fef895a2d558ab8fe49c01d92104495d29c55444234de2779f92

SHA512
a45698a1a522d74481565ed8148d6f790b4c8acfa6997ce108170393f932afcbf3076d5af67dfbc747af2f196cc5228990498464f7f085b524e972855e396843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7fd21610c8e4f7752094aff1507e7c83

SHA1
1c1a1b8496f5ebfe5050d53248156e603c6253cf

SHA256
87167d1925dd74094c81272ca6b8c39f9516f94f236bf3cba9bf852ae3492885

SHA512
9dd5c647d0d2ba005c08a13f8234c131922bd22148d44381e18d0c90d407fac47fa3be595e2683f5d9fcbcb4ccc4202777f6cddc298c5887485ff6f8a2964e1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9f71ef9e41eea98dafd523dd5c7428bb

SHA1
375c227ed0c1d1a2790390f07d96c73a9fa24a1e

SHA256
9e1c19223395e6d1e40dc552b58917f61cb3bfae12cf47b95627bec1bb9bdf73

SHA512
220354b62945c75dc7704143bf7ee6b3048ab688a05c4efacce4a6308d88e1457d4dc5f4f6d3345ddeff6974b01252c9ad8af002b7b1f74b713e1fff6386eede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
245ad93e205e77b01229cd3d29c5f024

SHA1
5fe48b3e2e9a31cf1a35b29926626e1648d63e9e

SHA256
8b782c2d7aa7b89fc7d4b183d1276156789427d9fb1e68f8e51c6a26885acc66

SHA512
dc3a90bd46dd48a2fa0f583425c4a90ab6a3db761ce3898101b7312b3e3e1244841f9efed6a27618d6b2836b41f2455b010c105ba4c948f1643b1a4a560abf49

Download Submit