hxxp://google[.]com

Resubmissions

07/11/2023, 14:22

231107-rpw62ahb4w 1

27/10/2023, 15:55

23/10/2023, 16:49

17/10/2023, 12:22

16/10/2023, 18:28

16/10/2023, 17:48

12/10/2023, 18:50

Analysis

max time kernel
1684s
max time network
1693s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2023, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
448	msedge.exe
448	msedge.exe
3740	identity_helper.exe
3740	identity_helper.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 1816	208	msedge.exe	81
PID 208 wrote to memory of 1816	208	msedge.exe	81
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 4320	208	msedge.exe	83
PID 208 wrote to memory of 448	208	msedge.exe	82
PID 208 wrote to memory of 448	208	msedge.exe	82
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84
PID 208 wrote to memory of 2956	208	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8898f46f8,0x7ff8898f4708,0x7ff8898f4718
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6537065131539427311,10545304309812119400,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
21f1054924c44cfee22821a7938473f5

SHA1
a86fc36cfef54def2341f1315adbbce2ea62d491

SHA256
2244f121aafa06e8ca8d21dc3b4c7ffb6c285780968fabb451b7163f34511da6

SHA512
5a94ddc187f91adaba4655206225a9b3f072276ced6af9f3d76fc6793b4eab7dd68ca076cc2a06adeb431b7c168fc20051368a3aba43ff28a9e5c240581e6007

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
34e43dde328e6cca24df8094ed4081e5

SHA1
a2819ef39325fc4c6cda0f5157d3fb6775e806b6

SHA256
3d51e350187f7ffdb4c4b7e8a0abffa3ae3c007759811fc651d9fefa05c6bf75

SHA512
1a0babd772d8c962ca65afde03897f1fea652c12aba74f421b5bafa4db7e4c43224b2ae353808528d08affb2e84c9cd70fe0701560445763d4d7e766e8886e29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0ba606e19981ba745ca362d0a61fed4a

SHA1
67e3ea0bde6d8b46170d316e22ac81a544419056

SHA256
41246090977d44876dbc43a6275aeed826ea9c605cc970b463322fff7af499ec

SHA512
4a47f3770d264775179cca15c0bca2a49fde97f31edd4fe4b49def5c583f43a6e70a2bbb3ffd02a6a9b1fcf0d0e82baad54ddedabca48e302097d44573aeba1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab596dfcd80835e95fae89c172d6e929

SHA1
7001817b5f0a75f8ee4f8266cac3862d0c02d6d8

SHA256
7a4c34f9a040b41ca08cf00bbb9e1384240bdc4848919b824bea3be091b99d85

SHA512
f1ea7926c873ff13573dabbd2320e6fce17b83827fbf9ff9f7021fe2436875bb1e104d91b0697b3c81221ccc173a745b73ae72603f1c1771124e47a7535fad21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7997c4a2ccad781438cf968c80d9cefe

SHA1
7296e66d7ea0e8133c0c3c251e0add3a6146be8f

SHA256
ccfa4c8b09f39a84312932e1716e02c73f7ea81e451d6a9e219861feced3a85a

SHA512
e02766e5245be6b95a7ba0efc402e9693e2fe5007fb50808c20cadbf0a990439f06e46ea7c5666145356f2b32e1a6bc20a7b6623911a60bba52b762b8ecfe258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d09bbcb5ff15d10476f7948e6d78b0ad

SHA1
c35a6250486c14476c6a66eaf9bd9c94f79c02be

SHA256
24d3989ac74d3148e4bae9263cf111ddcbb3157e2e4fadecda69cc99fc0bf1e4

SHA512
e8742dbcf5fe938d7a790b6a149397eaa57b8ab38a21af10791d80cba877a7059f842c208a1845fe422c4a930be4a79b19ddd1d17cc3015206fa0f586cae1610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30eaa617c9b2eb58c3e436bfa8f256ba

SHA1
5ad1d0428c6739c92bef2980b8b7d12d99d13d53

SHA256
281cefc5c6f34f2a01b2611c25fbbf4321b0aa96c6b5e05a0237d50c708bf771

SHA512
733e8d4d15bf3ffedf4c4e5b16c847b0254132e5739d128826ae96c0dba44edf53a9941dc3ffcb7df93aceceeea696aad41c2fd390b604eafdde25b02381da8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
25ac77f8c7c7b76b93c8346e41b89a95

SHA1
5a8f769162bab0a75b1014fb8b94f9bb1fb7970a

SHA256
8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b

SHA512
df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d2d5ee6a55a6f154208400a4695ca18a

SHA1
61b624c945832969f60c9430e871ced3241c7055

SHA256
418ef270fcc9cb5dc99b7e910f8fe9ebfc56321d9a27dd8b08ba250283c7c554

SHA512
702c17508a1ca36f3395a778f70444bf9e5c4a90974c76881b109df24f54b1e29cbaab38e8d1821afb1d3a8a0d9b74e2fb4da1904c18fc1d291545dbb6036921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4bb463875b1d1fa8689e973ab0dd9158

SHA1
cc48856267c4a8ce5990093fb7698bdcb5677a4f

SHA256
1f0112220c4cfc1f05f8db066d1697a23e5e79285f8e4d6ec31e3b9abf983482

SHA512
bd2cf3564f7007cff6a35bac64fdf3a5b311d1df1ac1dc96438d9df4520cfcdb5c3a5240b88cefa45be4080bb957a3f98e13b7809afafe8ccfa2af5d121e1814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
f3eb2441670de70945f6200bc4a6827e

SHA1
17dc3b0c3624f4cc343c736c55a8a6922174c09f

SHA256
ac6024efb76374e62166629c9fc19b0fbcb633b611ab4e2e0ce4b48b336fec03

SHA512
63beddc354b951093ea950f1dd505cc18876c7370500d1ff5c6a66b32a8784ee5b7d4215da8aca0825c284a431b6f8c7f32df38256464f576b64a6be45585f77

Download Submit