7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7

Analysis

max time kernel
187s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7.exe
Size

74KB
MD5

11dabe4bf4278eb6d5b4018019110b60
SHA1

e300b181cc42453a32b18053ed7f04a22d8e022f
SHA256

7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7
SHA512

dfca13b055dba67cda7f68e563e54fa86bbf56e0551e4ab296e8456f576c5f1e34bd6059944056e49b981996f74a5abded6a260db3e0ccce258886b824708970
SSDEEP

1536:TQ0rtmGnxMJsO/PgUxz97K7PGxVwsf2JIK4z0Qm24sPqHF:cIUsQgUh97eOxysf2fM0H24iAF

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
1960	msedge.exe
1960	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4864	4416	7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7.exe	79
PID 4416 wrote to memory of 4864	4416	7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7.exe	79
PID 4864 wrote to memory of 4820	4864	msedge.exe	80
PID 4864 wrote to memory of 4820	4864	msedge.exe	80
PID 4416 wrote to memory of 3320	4416	7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7.exe	81
PID 4416 wrote to memory of 3320	4416	7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7.exe	81
PID 3320 wrote to memory of 1600	3320	msedge.exe	82
PID 3320 wrote to memory of 1600	3320	msedge.exe	82
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 4864 wrote to memory of 4616	4864	msedge.exe	86
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85
PID 3320 wrote to memory of 2824	3320	msedge.exe	85

C:\Users\Admin\AppData\Local\Temp\7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7.exe
"C:\Users\Admin\AppData\Local\Temp\7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff8d1a446f8,0x7ff8d1a44708,0x7ff8d1a44718
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6404033732413647000,16977605784986768023,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6404033732413647000,16977605784986768023,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6404033732413647000,16977605784986768023,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
    3⤵
    PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7e6039f1759d33da255aadd0e23028c6e87b006984a14bb3f24873a481d1bce7.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8d1a446f8,0x7ff8d1a44708,0x7ff8d1a44718
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3144 /prefetch:8
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4840 /prefetch:8
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,3978164851407395929,2647008235715209084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 /prefetch:8
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7852c5460,0x7ff7852c5470,0x7ff7852c5480
      4⤵
      PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
ba42a3875414f598e572ad9918b07feb

SHA1
80dc573220e21b0ddb8e521c0c96877c342fdde2

SHA256
7c6af01d781e871079482d1498e3ddf3c192a83e709805b0eec13cc45780ec6b

SHA512
daccc620d72442a4edee9042cb33c17d773353597762449071ddee1c496618f491294b02da65b9a10e035dda859fac72271f746bac37d9f82da419f7c904ee4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
4b2ebce841a474265889ce758c232105

SHA1
f1362ea4394f5635cf8da05d0ee07dfb18fa8471

SHA256
07985900bd120174cab7841343a0f95d82b9b4bb05fb33aad72801a7928e4cae

SHA512
f4ccecc5bec87b82794a3d5885ab18d8b9edde1e90804e1bf923f52726d3ef93877e7179c4d65f1f09f855c2706e46139c78ff33fe5af23bf92d855cb1b6677d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit