c86557ca87ea3b31a78767ddf63713abd2a19584c2f650257cfe1c76ea7caa9d

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78a8e26e8b689ab653e23946b54a5e9f_JaffaCakes118.html
Size

106KB
MD5

78a8e26e8b689ab653e23946b54a5e9f
SHA1

9ebb4b13ab825ec420f8bf9131ec9992ab47cdff
SHA256

c86557ca87ea3b31a78767ddf63713abd2a19584c2f650257cfe1c76ea7caa9d
SHA512

e87d2157d34217f589f9b35cd8f44add53211623e6e2a39b7c34a7cac21db7cfff0e5f2d7d226c8944d59b8b21e0d4a47e9152ef3f48e9ec88e78bdd245a3a00
SSDEEP

1536:fhOrV46Bnh53MJ76YZLPciahf7ndDk+Uevc1sVIWlonFnZspee2u6fq9kHXl3TQe:byA76qhMyyyOsVjQMcy6F7xnFoD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
2928	msedge.exe
2928	msedge.exe
1544	identity_helper.exe
1544	identity_helper.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3380	2928	msedge.exe	84
PID 2928 wrote to memory of 3380	2928	msedge.exe	84
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 1148	2928	msedge.exe	85
PID 2928 wrote to memory of 3956	2928	msedge.exe	86
PID 2928 wrote to memory of 3956	2928	msedge.exe	86
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87
PID 2928 wrote to memory of 4580	2928	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\78a8e26e8b689ab653e23946b54a5e9f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7f9846f8,0x7ffe7f984708,0x7ffe7f984718
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10550769818626883503,14398439901208582673,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
433c892b97c29cddad085f40ed1e32c6

SHA1
fe1ad1bdba0c215811ab639333302e5bfae15b28

SHA256
a71d4bf703a5e59ab1a2338faae458a5f76a55c0a6e7d9496ec895959f57623c

SHA512
047129c3893ddd18ab3ea3b9e1fb969a44247dad6a5183acc846f349e8727cf920eef48aa06fe54c4d04ab5a107386d0b5f1573eec3e97057b44d6dd63fbd0d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8df66c3300266ca2d1460ad860ec21dc

SHA1
19f667130bd6036216e86490815468dfbca92c84

SHA256
4adedc8fcf402f62c46e026d2dd22f870e78dbaaa7fa7dd22aa585153e2ca01f

SHA512
0f563c0c883b231e4c34d2c8b68c6137504e782b5453f99bd97fdb2ade9bc05b10409fc23d12d8e92432b20d4b5d205b8838f4a92ba5c1b9d329fba402fa53be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5833c23f6edcff4826ad3fcf919eb31d

SHA1
8d3b475b09a17b7442a86c47e69214f1a529bf71

SHA256
1f77942e0bd0fc0eafda3cf278e37e011bc2bf9b90bfddb934bd1b89ce529bde

SHA512
87239d0a899cbbc72c3496d58baee32af3176e5ad88edf04852030ba75bfd3da14c4d0170e20180d1cf1dc27a57cb7fe72f067f6a32eac31394e560006ceb42c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4196a213ebdde4d799e60a9af733a5e3

SHA1
736ecfd76b4f9b9b65c5f9999164e4c7db815603

SHA256
f4168ac12b8e4fc25df9541667560173747a9d30efaa7d767c4be93c29683e42

SHA512
336265a0df1dbbf9816fca0cfa4c5460fc8cb491125c02603319743a774d6ee2361c8af0acddd8e0b3692023769359141205330f788ea9a9e2543878dc9c138b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
439aeba4de746bc0595d5e103bb9ea89

SHA1
4780aebf9e10461cfe13c8d818012e9f5e66eae8

SHA256
534efe1c2680d2fc1cf3e7195a4241687abb5beadf02bb4e061a46aa4bc0c9ea

SHA512
d5cf1ae2f74e4e5d04be1e082ab9409ed1fdc175b054cafffe9987ea0208e942a3cc60b8f2666645a00e1c0e2c90ed19cbc3f17f092712387bda5434cdd3ad7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9a491440a3e7bc80978df9b67cdc6876

SHA1
7ca50e4b581720ac9489ec699cc7533dba551b56

SHA256
17eb2b674325087f4551776632c148b0aca763cc5204120dbd0934f73cc500ff

SHA512
1848f13ca077bc24fef74640fa749811477ee014c8a02ae3ac9f3504bc27b00afed055e741fe2cfaf271ea4266f7f5340c363c4db4e4954570d673aec0bd39ce

Download Submit