hxxps://enzomatencio[.]com/ina/?NpFgJqYgGtnsDSuDjtzuolmteZbrqEbGRRPLdxtcvEXvJxlkBnhMjzIEN

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2023 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://enzomatencio.com/ina/?NpFgJqYgGtnsDSuDjtzuolmteZbrqEbGRRPLdxtcvEXvJxlkBnhMjzIEN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1972	msedge.exe
1972	msedge.exe
3528	identity_helper.exe
3528	identity_helper.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 320	1972	msedge.exe	52
PID 1972 wrote to memory of 320	1972	msedge.exe	52
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1952	1972	msedge.exe	89
PID 1972 wrote to memory of 1116	1972	msedge.exe	88
PID 1972 wrote to memory of 1116	1972	msedge.exe	88
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90
PID 1972 wrote to memory of 3852	1972	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://enzomatencio.com/ina/?NpFgJqYgGtnsDSuDjtzuolmteZbrqEbGRRPLdxtcvEXvJxlkBnhMjzIEN
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff124f46f8,0x7fff124f4708,0x7fff124f4718
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,621748297047810790,14584143820768985475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f0cdba3e639a70bf26cf85d538ce1a8

SHA1
b457faa0d6c55d56d61167674f734f54c978639b

SHA256
c1e48c2dfaeb607efc713e1b5c01d1ee8a9491d8f3a2a5f4f3887e6c1f8c2f63

SHA512
3c270fc58170c37f51427aac2d3092ddbbc17832556718612cebb0c32c04e7e3b7e157969d458a4b9c3e8bf781c23489319338960cefb5cf530673f2b8f81609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8777696da19a176ae714208b74a9ca78

SHA1
f6db50df2dbda692b24270b8efc9b0db7c549023

SHA256
038caa2b0ffc32505079f2a8feb2279d32dc5b2ecddf41e6e4204010d34a019e

SHA512
5c4f7fe45df82bc237d929c22ecfb38d95286f2963605e991198e638c770465fc4bf55ee722f5286ccee87854ffd077c344ece23cff7057aaf947f1fcdbcea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
666fd2eadd1b7105e013a7591437eaf7

SHA1
17a1a9d362dd2c6c2c4732c75727bdba81608e21

SHA256
2aecbdabd26773780a1ecad288efe4d1326ba859ad5466215b2a531606ccc724

SHA512
f564d91d7d5c0721b90956b4e715efa0d8984c12ec97d323145ea1ac1b77ae05a10311a9a14294407ed60a75fd133a23a7314099fd242e8ba718ee4c7a94714f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
45a7330902fb43b5c6bdf0c1fe9e455a

SHA1
73e298d8d040395d310007b2fcc064828d4d2b4a

SHA256
16d1c8d37d9c79dac38333040c7fd544a7a5ee6b2eb2af1d9ecaa0924f436c00

SHA512
99f2d998c35b470156e4662d9ec30540d4561955aa2e77b79c834fe1c3eeb64a8958ddd02f4d243717b07f19558cc9e25954fd7454bb88cf3f4ac8f9f57d9a99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
5b448e64d9ba2625fe575400e6625250

SHA1
61736d015ea660931ff299965375237ae06f68de

SHA256
4b54b1c7f5e83e97297c29b8c5dbb908f09e577b3aad6134d8eec8b43dc63994

SHA512
ff359cae86d4c056e501bd375821dc7783c65189dd59edb96ae2e9c64552f048a9ecc03f86164c53379141097c7c7c9be5f0bba3036abd23b9cefe393271f44f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
d0f84368505996aa44219ecc8c166b6a

SHA1
b09c79f6ebe7fc5d9ad2021debf242e3cfc58656

SHA256
826c999e90267ea2c45efdb82a3ef405d2a07dcc5a428e36055dbb6bda7d6f0c

SHA512
f3c402fefde9e2be5d9999f538c0ba736c4a49b52da8d5533683b058594ca04550465a629c65218e655f915e97eb11a071a6ec4cf06ebf8840e03b87c925292b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
688dcbee628259d0c169b024d7c33965

SHA1
0593c03c4f7d1901778ce40ffeb09b8360cf5dc4

SHA256
76c40323173b303fb2659139d41a56e69c3cad2c09b3930461b645e476602aa3

SHA512
9104880fa13ba1601818866edc70a074ca62186aeaf83d3cde906793310dbaf06783f3cda2ad13c646d500142d15a6248b5ffcd0367da6de0e251954233677d7

Download Submit