hxxps://atoaustgov[.]com

Analysis

max time kernel
145s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20231129-en
resource tags

arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
submitted
11-12-2023 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://atoaustgov.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4864	msedge.exe
4864	msedge.exe
3036	msedge.exe
3036	msedge.exe
1548	identity_helper.exe
1548	identity_helper.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 2548	4864	msedge.exe	78
PID 4864 wrote to memory of 2548	4864	msedge.exe	78
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4176	4864	msedge.exe	81
PID 4864 wrote to memory of 4484	4864	msedge.exe	80
PID 4864 wrote to memory of 4484	4864	msedge.exe	80
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79
PID 4864 wrote to memory of 2916	4864	msedge.exe	79

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://atoaustgov.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd4aa63cb8,0x7ffd4aa63cc8,0x7ffd4aa63cd8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,233386734916907027,8580316191246485757,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5b00a281-a48a-41f5-9788-77f6ff749a12.tmp

Filesize
3KB

MD5
e861ce6b8f74c2d8aef68a9b7f85aa97

SHA1
2c48d21a4b511240c9952be6eca7220d81ba6c7a

SHA256
a5129080f450eff1d2cccda4fc206aeb527276e2ec297271ddf17c24ca38e697

SHA512
c32a6b22e998926167d5478bc1c0cf1236a33caf4128e7eeffa025c72433d19c5d30d63b30da8a61d950f0f89ef443cc07dcae2ec1734abc0a215fd13a9e9699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db2e4d9e346a898461d3dd73a9bd1489

SHA1
ed0676dbbdfb85caa47514b1ed9bd1686e2b5973

SHA256
63ec89c40c09cda645f11eed75b85d332b5898d774d56ac761f511a36216bbee

SHA512
64979cc44300f1b648c1fe78b4a272fcdfcfd3e2f2b50bc6c8a780aaa074916cd2061b45642f719a2d9790d3dee7bf159e59081eeccadca38a1a5c638efebd06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
cb1645eb642dc76e50d06574d4b97a6b

SHA1
2b8f9ac09a4a08af3764a285c9f6a6da91d24b86

SHA256
f58aa86c44494e53aa04d807814d3721427e3a686a716e71106eac339503607a

SHA512
fcd66c9c5791f4677bd1b8cf71a7765fbb3b4c3163307c88cc1d2262309d09237f01fe3b1aa6c9fd5152e853c6a0420e6f03e792e4eb89e231f5af75bf1ea1be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
471B

MD5
b99ec435c9590bd28a6aba0acf1e51dd

SHA1
e53cf0ab554bf2d7e0e6b48d886e69dde849c367

SHA256
1c054c19a011614bc890dfb9a062b64d104a71abb9bc4070ed2e488f0ec802a1

SHA512
bd7e5e1dd6ccf7fd57abb68a093046e96d621d4fc78d0c4b84e7ee142a1ef8e1f52ac00bc0b7f149aac0889fb0cecc4df1e952c9d2f726fc9caf30f77348cacb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
d7778a464139d781dac8ff7cca607f60

SHA1
f8902cfbd493248ff84c681b44dd7271a99c6f20

SHA256
c425eef12c8e84dee2588c5229b65860a3e37acbd2871a226b8cf2fa2648c027

SHA512
e2f2f706db81a577885474a010ab604266d899dcf68686d2acff3fc96315c1061e1c7d73ade71e53f0296d99a5d3dc35878fdf3a9167257f64df11c098911e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30a69a363249e5019385c239208c79c7

SHA1
4c22e76592df5b2ab0e86bc300a57d102d68451b

SHA256
905fc910d01cdc9f296bb361a795c126195c2ce6d6ecc118a4d50ef897c7877f

SHA512
1f19b1743e4fda86d16882bc313072f57674d34fe87a25293427f7676fe07638e1ac20e5f375795eb6845d10141e8ed18e81919c065cb18920822e8a0770e480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
dd79ea9383545dbebedd5aaee4269eb3

SHA1
38210e4dab9ae520e1d40e1a71b4c43ab3802118

SHA256
ee707adda8cc76db588072e21d60476267d705909cc8658edb2e2e597669ab94

SHA512
d4aa3f525a959f11f6e9d261e2a35046f950d33c101abdfd468f3e86b18ae3fbf377a2e728c498a441b2925be73c674872c4981bc6240f1f01f3756eb3e58eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
8575d2558bb299396fd6122691d5b54d

SHA1
6c9598f5bbb5b278ff6410e5bb072fe1f121c15a

SHA256
6bec217b2df4a9dcf79613f776fc4ad545bbf83b46da34e04518dd00c8898643

SHA512
a0477dfc73d868d43cdbdc90465c9d1e6eb2f26bd3466d4d80a9d6fe9cb27f9d79cf0ef0084072f2a3b777aed08ef9f5b0ae497922a8cb46790149829ca5b8c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
7e9585fcf1d9225b7dc9dba2024dfec9

SHA1
f5254dda482fba2c00a4a0bd19b16bb7d7e0d80c

SHA256
586c7fa68a358955656cd710fa9c277cb60536f8c515c31e346ce499290d3c14

SHA512
ad442872e14bfd825717c330180eb3b8c00ca2dc63af9a90a2c97c251c08838cbe7416c647ea53ab3d611f2bf7e97502a3ad9b0b699b85f7170cbeee8ff1c872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
188d9f9c09cfe939e19916edaa23fd00

SHA1
eb2b9063bee425199fa73087cd31a4c26c0ae1ed

SHA256
e60f0ef868e06552ec2f84e5872cf928e870ac34dc5216522969bb4b8f3f7b7e

SHA512
6bdd84f6024dbd3797d615941f5f5e49f7c061b425fc9ddfdd33a319bec4bef347b3e60b593d05ec7327343c3c2837460f6dba9ddf4c42f45f8f16aa8a5568c4

Download Submit