hxxp://google[.]com

Analysis

max time kernel
1782s
max time network
1732s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
4664	msedge.exe
4664	msedge.exe
3592	identity_helper.exe
3592	identity_helper.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 376	4664	msedge.exe	55
PID 4664 wrote to memory of 376	4664	msedge.exe	55
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 1012	4664	msedge.exe	88
PID 4664 wrote to memory of 5092	4664	msedge.exe	89
PID 4664 wrote to memory of 5092	4664	msedge.exe	89
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90
PID 4664 wrote to memory of 1980	4664	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb468146f8,0x7ffb46814708,0x7ffb46814718
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10827174411598662821,14844314681463081411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
26f8219c59547d181c1f9070c2f5b050

SHA1
cbe34c1b41c0d86e1dff1a0bd82b6c803085a39f

SHA256
3f534bb6f67e07afe3baf85bf750122c2e00b86df6aa258e5752dc6c946fc2d2

SHA512
1600ed7fb809d9f4fd571b99e606ac92f0054f684b6b7a3b72ede39d5edaf458cf551c568ca1bf967326bfbdaf2f7178906fb8d15d82c52049fb6c74205c9f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63c62da15efa834bcc4067a4b9590480

SHA1
cf50e91998d9a50f687b3e1ca7469ff40f6b321c

SHA256
30ea8806904e7ac337876809d45c08a895d114c4bb14dda91b7f796e220571f6

SHA512
be3ea82ba8e053f3ca768fa68ffe68b4be0d0dfc9c4a5d54df92a18678f5e91f760d16dd01e222519e0780344702f6cc3fb3397e7f69379da8fc1644715f9da6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d41df1a34ad94d8b15d0abea99641452

SHA1
bb17fad7e1a1ead076571dc98a476c67a9afd94c

SHA256
58241bc3b848ca4c559ba3c8d221f36de13bda7c406951b593651978c68c73fd

SHA512
03f908a20dd202d91e167767ec636929f4318b627302957b7a8fe99fe33f8d48d58e323ce9ebbd8dc8cffcba226d5c76f08e8767dd7eef7d6fffe167abcdf1d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
f0be996849e6a6062fc9d0def8be3554

SHA1
1acf3eb3bfa4d0708909724a6827fd089a4bd1b5

SHA256
253b842d3cf5ddb9f831a58ecdb80fe0e97a3e61d7bdc0171646c233e08d43cd

SHA512
023cd417223bc6f0d0345d8e1925c57ff14907d3b6d4c387fcea2c80b3a2321662b7b1ba51f8b0c65470dfb85076ead960b2869846e97f5d40d59a2f56de04ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
ce4b475017b4a7cb4115306c6d006e4c

SHA1
32998d4ee49a80cfd05ba88a8eb56cf43b9f1adc

SHA256
2595d4a5d7f3dd0f2334cebd9750530b528de8b3b6b5e39ec3486329f286a808

SHA512
89f8b3e3146a323742e6df5c9bdcadce3a1ccd0295a8a265bc821730d6365622766e444375ac2c0451d13ae02257797244fdcbd03f51e899f8b4aee3e9a2e9cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
93389b5c68850cce3dbb2657d88379f9

SHA1
b130a6533b19796da2a7c15ec24daeaabe26cdc6

SHA256
7d92cc3dc41f2e44eb36ce4662bdeb0ce6d812bdfce591ed608279d7d4de8030

SHA512
25979e9caa83460ecd5e535bdcc351c113fb18eaeb448f6441b22d249a59605ef675ca6104b778b191a11c32f91b2535564ebfb75c2c15df0aba690dc9d9403a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
50dcbd7c7fdd9bae87c6a88c9daa0e2b

SHA1
bfb7f86ca46e29b04b397e5fa9fb335d2ba7435c

SHA256
4615d8ca6a0321a3e66783e437b77bd012ed4fbaba0fcbe2559f15be44951ebd

SHA512
0000c873057e903a3b66888ea6a16dc9cd2a4544166c052b4953980be67670e6158d8e098aef6a8a4f7cc4e92b5e19565533ee24405485e8c2b47da684c1daed

Download Submit