hxxp://support[.]google[.]com

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://support.google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
1772	msedge.exe
1772	msedge.exe
4960	identity_helper.exe
4960	identity_helper.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 3332	1772	msedge.exe	82
PID 1772 wrote to memory of 3332	1772	msedge.exe	82
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 464	1772	msedge.exe	83
PID 1772 wrote to memory of 3172	1772	msedge.exe	84
PID 1772 wrote to memory of 3172	1772	msedge.exe	84
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85
PID 1772 wrote to memory of 1504	1772	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://support.google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb49c46f8,0x7ffeb49c4708,0x7ffeb49c4718
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14411563166219550531,308383608192313447,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
0716965c072a7b9fb29095dd9b9e1131

SHA1
ef4470e19d744847a670f9e76955e4c1bb5cad20

SHA256
130f39482dac7f43b9f4cace8f92b7658b0522ad405ca9f7f55157beb0bfcfd8

SHA512
fb03a5e0eaf2db0d8f7fe66ae9d45b05814c3644c32d8b8b313ad47cff82f003907497629d0c126484928df4f453c01ca4109d10e2e7ebf4912ca73ca892fd4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1e03625fa2e1f48bd032438c8845c09f

SHA1
5b6cf22547a28eeee0d64b47753b51f4ce6e14fa

SHA256
394c2b9e5dee2a600eae1443b7c0930c7b8b3ead2c3ca74addad339f7161da2f

SHA512
132ea59b39fcbd9ea92b897b72ab5ef2b5ec94d7ddd89d8113f685c6a3cc79acc394649e637cca48e945ddbd94e95fd6c2186b50bcd85467cfc7fe25aa4f61b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8dc2236bcaa41e1a16772d51031f0bc5

SHA1
575fbf72c0e0d767edd87705e13981a823d89ba1

SHA256
f1c3b16c38fcb8e0448d5c1615647b38b790d6f87381c36483413b40c7b19144

SHA512
45693ccdbccdb005c406d3a52cad0f1175b30a453e2b67c1909104691a638ecde3de679ada299378828207aba7c31289ad4c79a14d13db8a8dd346826de30302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3c122797198876c94f96f0ccf3a81841

SHA1
dbd70e890f6a54b7fde69d7c54cda526ca02cae5

SHA256
2a067a6194f02d8d241062fb39a04220112ad6e9e179415ee366be2467e4c3ef

SHA512
616804ab5eca0a0169a25adc039eec7fd7f660aabef1a8167ae05ade293d565d547f1b16c788520fedac0ddd552609a84b7c881de6ad6e47716f7c11872c1b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
67798f2317d6c7f9c589a2ea4e561195

SHA1
82894ae2ac60e6a074d091a484a23cfc64fc3988

SHA256
9c99313ff55f118b8665ed029c4ca211e7023071552bafd2aff67e36fb38c0e1

SHA512
d892b28d3c1268dbb937291340485bb915ec4d60f66994e3aa00ca1fa46f0b6a04754e7b5fb81ac7877a0bbf69cfdcdceaf0566265b3d20c81c953a061734e3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec53a420fd161dc57db35c1753bdc3d1

SHA1
ac4939a70ceedb78920711840e36824d14da70d2

SHA256
13230fe2e41831717dba310185c617d3bc830235df07ec05a1e7fd58485ee6c2

SHA512
d9352f786e22e9a3cf309a09a1fdfe99c7d8cabd4e63773b8d9cfbcc49a5682ff865f7aaa74bae40ce4f7d7cf584caf4b3381e5d34eba44a8a296707bfce8ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4a078fb8a7c67594a6c2aa724e2ac684

SHA1
92bc5b49985c8588c60f6f85c50a516fae0332f4

SHA256
c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

SHA512
188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
570865c0971d6afb87a2279388512f2c

SHA1
9f2920ee3b2066ff750ddc505d5bed5ef42ef7d4

SHA256
962a31eae36bc53b60d9bf53a383be97245fc272249d43bf336fb860b152337d

SHA512
b8a0757cc146d996924b94e740c059c04b47a299c0ce171cb66e95e7530b002d34995b2d96c7fb37d6bdac0399c16d75a63a0227106943802f65db4a5cb52b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e416.TMP

Filesize
705B

MD5
ee6cfbd4da8c32bcf63adff2967ae73b

SHA1
1faaf6647982d043d370c783126e4b9265749fdd

SHA256
115f31550305c8bb5f35c0a787f2edb75ba35ec847e1f77e8f08542531e667ee

SHA512
7fa5fcb397286a132c5bed009d007ea3da5b46e27b1ed743aacf55552e1166bb6cfe97c3680e907ddd100aa073e1f4e6e884bdbd7e47aca79f0c4895d04ed287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ed09640082a8be2d347bf7ea90a62a4

SHA1
4f2bdc546f2c450f3fcab818d91803b591fbfa28

SHA256
c896fa03a09d18012e21db60a03ce6d3ff460283f4a894d8cd28ecbf7c93bee9

SHA512
20951b5ead05d8a99143f2e8fad34447d3d7a034504ccd59926081a03b16e6eb3903f61844adad3efc907f21c7d81ae2bd1c14ca991f9a8aa8140229c597b2a4

Download Submit