hxxp://pub-d118bf344bc9405b934b05216f5d6a6b[.]r2[.]dev

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://pub-d118bf344bc9405b934b05216f5d6a6b.r2.dev

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
2532	msedge.exe
2532	msedge.exe
3304	identity_helper.exe
3304	identity_helper.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe
2532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2728	2532	msedge.exe	72
PID 2532 wrote to memory of 2728	2532	msedge.exe	72
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 3392	2532	msedge.exe	89
PID 2532 wrote to memory of 392	2532	msedge.exe	88
PID 2532 wrote to memory of 392	2532	msedge.exe	88
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90
PID 2532 wrote to memory of 1868	2532	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pub-d118bf344bc9405b934b05216f5d6a6b.r2.dev
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92f6546f8,0x7ff92f654708,0x7ff92f654718
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17646457593258582965,12692129186435651916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f0cdba3e639a70bf26cf85d538ce1a8

SHA1
b457faa0d6c55d56d61167674f734f54c978639b

SHA256
c1e48c2dfaeb607efc713e1b5c01d1ee8a9491d8f3a2a5f4f3887e6c1f8c2f63

SHA512
3c270fc58170c37f51427aac2d3092ddbbc17832556718612cebb0c32c04e7e3b7e157969d458a4b9c3e8bf781c23489319338960cefb5cf530673f2b8f81609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e74b09f9a4dc9b4c74e86670d39cba1d

SHA1
ce0016e6d37c374e6c304995369a4a220456a3e1

SHA256
0575ec81f60d9e691476cb35123320db18ee6b0da366255d46b0ba43c31bd2db

SHA512
746d528b84e32ed60564be83e75f11175b293963cb449187442209fe58cfc1ba5138437842facb06b40cc4c3679b55c135a34a55e67736291c012ee1fa98d8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b965f99ac72d6f28bcdf703b93605c72

SHA1
b720af37d2b1de0903d387e5a50949c521fcc69f

SHA256
b3920947a1498136d15c8fc832a7c29e4c51eb49c6fa86672a4fbc52eb9e43a2

SHA512
633c1e02a4f1ffdd9e553cde24c67b66e856b28edcef34642e8bbab4ca7e24666a238bc8286ab144faea3ce8af8d62d932bc9af6f57082b13f2d4ef1a6f9b1d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b1c01d9f2da4c4a82b644e123eb062dd

SHA1
308852fb7a9b05d6aea7ebc3b7988f6eda58bb6a

SHA256
451437712b8789d5149690c71b25beab9583187529219a3c0cc618cfa3dbf92b

SHA512
7bdce0b0228e9bcb641bab26d56560e96120e03e1052cdb97dde8f31ac75d8c1ebe9f932f70f954978c746cea4f193e71e0ddba8de744ad388cd09008d371ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
b6b47cc89c22d3699f0902f8690a6369

SHA1
7d1057ad5b0aca8e0fd651387ffa5ac6a2317905

SHA256
7675d3c09f6bb7c34ea93d491db84e7dff6820b75217144108bc16cb276c53a4

SHA512
cc56eb2149d7c695789874d03133835834c0e47456b82e366df8e51bf669158e4fb284438fc211a2a9ecd66358b3a94b7b4f382f1e149c4375a8a417a362bfc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
15444d365b2c010c3455973a654b5a2d

SHA1
92f91cddb883e8414e1c0024cc33ed4095734e3f

SHA256
366aba3f671b79c9289090e5fb224820729953c2c2fb51281a7e2a995dfde927

SHA512
e584eafda164c340a5a278ec6c8ef86117a82be5c741de7db72c8f01ba369da3a3baa0a87b3389561ee55162f4131008339e718c0ed7942e22eaa1685da99ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
e7641e48518b40d3c7fcfe226836947f

SHA1
ef0360e80075872bbe1efdb89df0f002b66f4f66

SHA256
571b687ec84610e43da6fb9326f515babfb18b1035c928b8d9125dd8b36515dc

SHA512
58df6e01775bbb65ffa66dbe327b72a6089f55caed06cfca81377899cd0b06ac79602af55b6756046b05c4588d4dcf656b8a7e278bc74f1a81b68c2ccf5a195d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
58d5f049ba5508a3891173f05ea46d75

SHA1
cf1d204930636cc52159ece33f479247754bc7cd

SHA256
cbd336738bfa0bb5b368e56c42493747c65dafe170375c735decf78ec34b7f82

SHA512
b2991e8c578587f9221279295ec523e1c1039dcd93ab7c0aeee498dd67f5846ffb8411518d0edb2018b8833377e3f2ddfdb1f91db0da03f288976f91bb5998ee

Download Submit