hxxps://getshared[.]com/ByHLM1qL

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://getshared.com/ByHLM1qL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
2992	msedge.exe
2992	msedge.exe
1164	identity_helper.exe
1164	identity_helper.exe
5264	msedge.exe
5264	msedge.exe
5264	msedge.exe
5264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 5004	2992	msedge.exe	84
PID 2992 wrote to memory of 5004	2992	msedge.exe	84
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1768	2992	msedge.exe	87
PID 2992 wrote to memory of 1248	2992	msedge.exe	86
PID 2992 wrote to memory of 1248	2992	msedge.exe	86
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88
PID 2992 wrote to memory of 2440	2992	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getshared.com/ByHLM1qL
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc8a8b46f8,0x7ffc8a8b4708,0x7ffc8a8b4718
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15977312844259121487,8105735069496584690,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
185KB

MD5
a9673bd087b4e5e2cd21862f8b7d8054

SHA1
0854f56b37b3c7c3938ebdd75a79be32c94b281d

SHA256
d4226b650de255fdc92e6ba1b89181c445fa23e82e86a1de62059ffde35081b2

SHA512
3e919945421b284915da26cd49d55db1e4c5b0530cfafec936982e2b6f400e372b98df78d1f07813a473cf9f26699e9c1ffa555904d6d2b4fc819b2c202afaba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
31529c3ecc5e2b2dd7f4a8d7087a5dd0

SHA1
4a95d5caa8dbab8657502d88c14a070a078168dc

SHA256
75d552fec30dc1e476ff62a1139d1a499bc53c0e2bafc65ae3ce3a6a32585ba5

SHA512
f84e5d4de0aa644002efab49a050519508ccc884c9a4a4fb09be98b143074220d95dbea9f1af3fc72cfa2f57f37fbb50caa7b07e14dde28cc0a1ee744ccb1318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3046578a6151511b09c99a960646170a

SHA1
b36db7a3fdaa93e347831f33e583f4fa289f9425

SHA256
28f3e4ea7c5cdd3ff0c5e907e2bfba53ed40affa561bdd6666794c66392b913d

SHA512
4c04f443b5d5bd8a9edf284bcbddc7892b15f90e337d6ee0ff267c28c486e39c225c4d0d49479114f1a71a48f1448c56bd498ce9c7f8468357a887fa959c8e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0131cab616e25c42255dc632f1f7665

SHA1
6ec5c6db381e12f03ab827753268bf0618aa8ac8

SHA256
78cd7b86a7968014cb62185ece529e0b5f9233745105cc0e57f51c97bb7cee0e

SHA512
a89479c563fa76a30b04da275578bfbb53e0d76605dc9028097ee5cba193b4b3bb337351ca8e7c577f20841ebea0d4e1159901ab5da8a41b35560825b3fac274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15434d92995cc9057cb577368b591799

SHA1
99d052fa02dd5b74e8bb51e809def36511958bb9

SHA256
9076902a7fa603d397cf9b2b4c54c9951c78de49a47ebac7b646fff0d653ab9f

SHA512
18b44f792ad42e19707c7021da99e48ecf5b11096f34631d5c522689124b72d444f4775cfa0b9e4df8c6a203487f7c54373b301a54d8cda5283646e95855844f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a02572f643b32942823c6b2a765ca6a

SHA1
43f7cb163ddc6348d8fa69a2b5780001a6e87075

SHA256
6fa79514a249013367ef107b5bce9426a761bf4c0b75726656412dda2961b677

SHA512
06f50771a69f5bfa49e92c2983ee9a9cff16b225cf24bee1d259a713798c8307aea66ceac0ebd002a5e1cda6067468f9469e8d14c9f37761fee5bfa6e2506086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e2cae9045e1d3d7000ed0038588b594b

SHA1
bf5671fe57a53735d42a950d0ffd11c57c464c7b

SHA256
8a8313d5de9bb0634f28903b9f49689ba359508e901591d891b535ad62885ee7

SHA512
13bbf006f150e83b2f0fa02ce162e8a56c333cc54381d3f0b6d8c028d460b63625980ba157a8244830953cbcc8e57c1de5b4f26130600f62ae2f5d851eae00e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57a21126123986b0f8f32a22059bd802

SHA1
1c27de3f45e2ad264d6ae770eee796f9d1f2ea16

SHA256
42408c1dfa3489f9fa32b8c612ca96fb74440f12465cf0778edc625f2e168e9b

SHA512
9d455b2deb40b34a64f971213c5ae365300759407d93581e7ce00a512708988c2d2d73abe22475fdded200f9607ce368788bd51949f15dd602360b6ecd859eff

Download Submit