hxxps://aureturndue-plan[.]cc/AuClickk/

Analysis

max time kernel
241s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2023, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://aureturndue-plan.cc/AuClickk/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4108	msedge.exe
4108	msedge.exe
2500	identity_helper.exe
2500	identity_helper.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4136	4108	msedge.exe	37
PID 4108 wrote to memory of 4136	4108	msedge.exe	37
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4676	4108	msedge.exe	84
PID 4108 wrote to memory of 4976	4108	msedge.exe	86
PID 4108 wrote to memory of 4976	4108	msedge.exe	86
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85
PID 4108 wrote to memory of 2940	4108	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aureturndue-plan.cc/AuClickk/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc160246f8,0x7ffc16024708,0x7ffc16024718
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3381171978954320001,18343542280081274008,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
483924abaaa7ce1345acd8547cfe77f4

SHA1
4190d880b95d9506385087d6c2f5434f0e9f63e8

SHA256
9a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684

SHA512
e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\793d8866-f91b-40fe-a9d3-eed02c46a61e.tmp

Filesize
24KB

MD5
1c706d53e85fb5321a8396d197051531

SHA1
0d92aa8524fb1d47e7ee5d614e58a398c06141a4

SHA256
80c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932

SHA512
d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
86a1d4ad8103d78ffefac307084328f7

SHA1
cb05eb36e762f0c93bf7b3de0903683b01b3e62a

SHA256
b6320a98d7ade4681231a797a3f2b6a2a721e33514deb91ba39f1c4b8b595c8d

SHA512
ad693927bd2b8774ebc2f9f56b27860fce12fd3287574f97886d0f968c5890657f1d07f1ec55a8ac1a629ec0277d124f3be6679801ecba0bc225a492bf28b9f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
723a80080f133fe4a2064d384fb9e3b7

SHA1
9157e3ce02faa3e0ed58d287157d95b54cc87282

SHA256
d947fb74dc5f32d07c8f4d9de13f8a2cb99d96017abd5630c5096d84625d0687

SHA512
9d6f32c2aac16599a4ff309508250aa0781513b3bc4f5c59d9f4d414123957c73c899934210899b0910251ccb13b7e82dee1d6bc65a6b361e61283ef095a51a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
553B

MD5
46611d8110704078be4d5cc031d687f7

SHA1
9a51b811ce5837b822c1f12ecf6270277e500e58

SHA256
ec53bf5265f8cdd14f32f4ffa6af087930dbad01190e45b5b518acd1e0ab3e1b

SHA512
3c0fb414a0a30b35768fd94b0ce1afb28449801516c39405112c7d2e972aabd30b910583e031217e9ec8c393c9c300151d7d5290b29fd8c01d1bbc6fa98dbe97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
553B

MD5
1aaf44d57fd49682955b37f05b0292a0

SHA1
ba2dc888504d8f9c2fae7675f24b1bd11438f395

SHA256
05f0e47fdba399b28cd70335d9a0411fa33f15c6d9e52f1f7e90c01ada68336b

SHA512
0a293ef30c0a5c63f1d9f76410ebb23b2a80ed6ad3ea57aa367dd969ede6c11685bec889f49d5b06bd7b017bc26d9d016040dfbfc5b55eb4b0dac744ec5e4443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a10c0f201b16bf5f7b36ea5b39a8a67e

SHA1
333327b9e75995174718f29b4d88025038f684df

SHA256
e367fa47a24cc776d2a0a27d5b1f8d2acac59c99e3a8e531c4ac34fd032c168c

SHA512
8990259260f69dabe58e13f330f70f5fcc22f19a2f9e41c44823c3f00f6f7baf72b0459742299606b5fc11f6e7efeb61769b5eb5d0f6517d16b7ce51b39d5fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6bc3a4c785c3c574360408f59bb58364

SHA1
689c840ca24ef96547043cf061376393358f7fd7

SHA256
13ce0f3b8d2639992e083a55b7e25b8e8aa1859dbb2f70ee8d653f80e971d481

SHA512
58eb4c48f2932c0ea7812c41c6a295e85dc5924cb6046371e3335de2580dde3d61599c0186ee40ab0527946403492e9260a838ecebd84ebc0c5cb1a35d8ca994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1085cbe983e009491d6a617b9efaaab

SHA1
408c94fce22d2217700aa7be0c00eb3a2c6874b1

SHA256
bd5ad9a2e9078b04d438cd1d36b9b077c5d3fca48afbfa57427e5faa48645e0b

SHA512
a5f5a840149b0178166fcd399b7ad412b354a9bbd59b2f6e09583b96f82cd20d6619cd2c9eb860a73cd20c7a877523eb6482ed8b5595a721878951caa37faf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6ee7897455e51c75373bfd29e80ccefd

SHA1
c150189f0338c9c1486d8ec15d8cb7c58e485482

SHA256
a36fb60ed2028a5049c75cd2504a6b8c11adec2cb961d3cad2e82ac8de4c5bc2

SHA512
033ab4b40102416e0d8a6f77968381c3b546601e51f61ea6034852bc76d38e9be300646864392f59ccdc5de2c7b2e03cd7ec7e039a083703388b5a5a99f651c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca15a2253f7c9304689c78395aeeb6f6

SHA1
22668bf6450944628ac9834c272c61f0d91fb7f2

SHA256
c79292815c8624f68bc9fc3a79e7f1d7df8bc79f50c95c57440fde78df8a7425

SHA512
003a8b046bdce5c1c7c186292a67729f61eb7e757371bdd884e063a86fca46d47d9a8e717284cb1b9531efa5c5d695269fb6eb634642fcda55dc13a25eafbce9

Download Submit