hxxps://s8501561[.]sendpul[.]se

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://s8501561.sendpul.se

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
1356	msedge.exe
1356	msedge.exe
464	identity_helper.exe
464	identity_helper.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 3752	1356	msedge.exe	57
PID 1356 wrote to memory of 3752	1356	msedge.exe	57
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 2980	1356	msedge.exe	90
PID 1356 wrote to memory of 384	1356	msedge.exe	88
PID 1356 wrote to memory of 384	1356	msedge.exe	88
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89
PID 1356 wrote to memory of 4704	1356	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://s8501561.sendpul.se
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffb181c46f8,0x7ffb181c4708,0x7ffb181c4718
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5979023773154878444,6939151670283610602,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58a9ee207caef8b6881b10e37b4cbc97

SHA1
fa5f0c8626915f39161abb48df2212a79c9c6abb

SHA256
fa60e147e18bd39cb6ce21d725ef37a2072d1d682547d9f7393d3f99e63711f4

SHA512
dd20d10299a8c628c74adb51239c3869a01a731e42946f0039c9138c03524d8c8a940716226f10aab0b0c7aa230195a27e91aea54eed611c6e5dc9f02fa90355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b02b6ebe4a40d2cbba694932bcc22be9

SHA1
06578cedc7e38e352b660e0ac41d3c6742c13e66

SHA256
bd4398fe90b14b5eee7b299587e63ea010746e0bf9c14b6298a291220b6e336a

SHA512
a3a238acde34cb1e79080a4347a7aebbea72fedcab1b8ea027e3081a311fb6acc3741fe8e1e85f5041f4de78685e1ae19703128477142790ef1034cb56b03fe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
faacbd1056cb9d2761c6fb0e5de2c082

SHA1
f94c369b649598458ad7f09a7a5b972e4eed4656

SHA256
f6f09eed75278a6b598d04f028058b889f79db1c90d4c0556d67d8d90145ac34

SHA512
1a82fc842c2a2ca3fdca148c7e75c973f6295b28c9921dc3d4d5132ccb391eb345f3a660510a74a4d9f3ec7e29fcd7304e52490813c4452bb5e6951538acd5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
83058550fc348a2c81be763c2abfe0ce

SHA1
0bc74911ac1074b146d3582a5036e9f54f9de482

SHA256
584439e7716a28f5a2cc8b2955bd74d62b65bd296aea38aec7a07249a6103360

SHA512
e72c91ffaa3226c821956c4f641bd6916fcc1d8f5f97f3a14649ff2f87438e754eaadb3b6249effd6cf65c3e2d996379cd3c85c2b35969272d26b86f87507ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
7161e96ee36b885be6f8426eae924e3a

SHA1
66ee3305bcc29226aa8e326bbeb784be530063d3

SHA256
e1e96cb220758badfb8eb08bb555c5a0753388809cb041e311f62ce095ea1c63

SHA512
f07f9117a29b9099beb346cd97e83a89bec8c7dedb7293caeca3f147e6f526f85cebf3db648613864f350934df669cfbc5b2fcb45462e48f7586db68803d2388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
0dc21e04450ca68748d30f121f35b80c

SHA1
83f6cdffb110ba7aaba880ef0bf314f23060ebed

SHA256
ce876fa91b4bd7436973b8fcb98863ef9404ab45ce62e322d13c8bcb0de549c0

SHA512
04efbbe6086ee8b8d28caeddd7194047bbff5096530641236a4bcb74986c1b8ab026191686285afe784e5ab9a81e0329c224dd7c995b1df4fe88c15b33198528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
dd10215d44e69339a18cab34811cb5a6

SHA1
706ea75befaaedaa5b9119f90a84cef9804db226

SHA256
4be688e02d946a942cabcbc5edb7513323fc85d6518696774addd4d138657989

SHA512
a7d6aabf68845c1449f134b5b42d49e883ffbde0e363f17de2a48c276501c95521743bdb7019e46a52b9a3f63656f6d5bd84cfd3569329d18f23883e02de80eb

Download Submit