hxxps://github[.]com/XPower7125/memz/archive/refs/heads/main[.]zip

Analysis

max time kernel
91s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/XPower7125/memz/archive/refs/heads/main.zip

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
1020	msedge.exe
1020	msedge.exe
1916	identity_helper.exe
1916	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 520	1020	msedge.exe	83
PID 1020 wrote to memory of 520	1020	msedge.exe	83
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4892	1020	msedge.exe	84
PID 1020 wrote to memory of 4260	1020	msedge.exe	85
PID 1020 wrote to memory of 4260	1020	msedge.exe	85
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86
PID 1020 wrote to memory of 4564	1020	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/XPower7125/memz/archive/refs/heads/main.zip
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f50546f8,0x7ff8f5054708,0x7ff8f5054718
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11304228097866600980,15311483418164924579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\86f48205-c70e-44b2-90b1-440b44332b95.tmp

Filesize
4KB

MD5
ed79166b9449cbc19415288fbe52423f

SHA1
99416fc56e31e4c7d3c1774088d5f3ee5a9333c9

SHA256
23fbd282a43e2498bab53f5d142f3e2c22ed5df814bafadf5f8bf66fc2356165

SHA512
a8277089598834f6b8f5a57bfb6910798e7239e0099b16bd45a3498a497602e27b65690ad7f1c6384b940c91fbea5df612ca267d3b267ae82a8b11205b1920d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
98ab7fcf6f9ef910d4fd790fbd6a5702

SHA1
75ca002a3a3dd04ad3d35b5e0c074cd01834fdba

SHA256
1596ade9391ec5c6ac619a0b083414a1d160bbe9e1ecf36efb998e6d33b1171c

SHA512
042427fcc9cd7e14d0fa4babe214d082df31397640e82973eceb6479f36030982e3e7eea8a9103cec1062822b73eb0905a4747a3601fb6a9261c7695a47b288f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d10990db7767ca233a44c1fb1328feff

SHA1
f4b6f6a5cb45e0062e2567c74f7c0afebd64b618

SHA256
c29a36ae1799169b509543d5c76b79991c32068f9e3df590a0de5bf347d259c7

SHA512
e622666d5c72d72d77fd069badc6715e7b385954f1e7220e2c70dc8318dfc344cb57c07ce9a02ef0512502a86312aa7a0ad12b7f43a58e99fa00eb45bf3300bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
47062fd8aeebd906e2ef4bd3bc628be4

SHA1
836cc19f22bc620db410f7b654c63f47271f845b

SHA256
079dd33af799e2f6de7574ab9f5ec3c51b5051e7c66aae1555f095dff0e9d223

SHA512
df36376fe19c7f24525b8e58d53da565b12cb9ade363981291f7eb55d5e88ad785815fd2a5db95b3d0c4721c885465894169cb4b0e365147189bc9688376dae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
422753d674ca6e3ce952836dfead9c00

SHA1
e75291c1ca075b567d04b89834a1b261942de8c0

SHA256
63319426a5345fe53bfb69676784c5bb593d3d3f6640d3ee5db3d6a9927fd44f

SHA512
fd10cbd9f8b4fa8c7e8d5012e0fa20b4d6c277f3b3d42498f33e2bdb339e22c30672b1682924e85b32ed2b18d8ebc8eb17d0863ec96d7b1059279c2f887bf6f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
cc82302dfceae651ea26b069d61ec4c7

SHA1
623f3e9dc620aee0bb3867aa5ffa3d0a09e337e2

SHA256
2b2c1710095cfb33359ed352294249d341b1bb8fe033fc170b092d78bbfc1ef8

SHA512
7c41da100d547672eaf0d97e0af8e518f042d99ea55acd3c7b74e00af23513409e5958901b1e9418578d29ebfa46365d5ee03d31dc0613bd9e30ddc04f0166ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
3806ad2a2686f08bb40e3c1a9a289eb7

SHA1
bf1b8359eb7824caba4ba67052ac22e5e68a4c47

SHA256
ad96b90c409c3fe7040a33be4c5f51f79b6e4090fa4147fc26d8cd16fd7c29a4

SHA512
b0b3658d118a05c25bfef2af2114d19f9069f31459c77a2a5cb0deaab796fc8faf70c0d55c5b3490a427c234796987bcd912cab3185e536cb56457d2bd81165b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
1660c1bda760f782cfbd5db9c76bd837

SHA1
8441598e4eb53e355ab1d81769930632b764a6de

SHA256
04ee2976fa97051a2cc603603ed36ccb7ff57a414179f7aa45cc217f4ae00dde

SHA512
73c547d5736a29ea11415856c6e9a05a69b0aa1b7dbab1ac6c585a85050fc10ea52617c36202313c9c311738346f7e9516af3342b7ba5f44c87ff2741d6643b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
fa1e4e7e0a8d122668a6e28b9a6d8906

SHA1
55fcf3554e1533957650492c7edc852f28b19a08

SHA256
27385ebb401080bc9fdc46b383a6fe2726250d09500db31ecf049f5270e8eb26

SHA512
284632811f9ac285189d45057379165e0a8377f0a21df9e81279368c606df1f0ed1f00374885c333bd4ab55cec27bca5ca682da5df496864b2326f87df17d564

Download Submit