hxxps://filetransfer[.]io/data-package/otsHgOW8/download

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2023, 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://filetransfer.io/data-package/otsHgOW8/download

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3292	msedge.exe
3292	msedge.exe
4572	msedge.exe
4572	msedge.exe
4984	identity_helper.exe
4984	identity_helper.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4392	4572	msedge.exe	86
PID 4572 wrote to memory of 4392	4572	msedge.exe	86
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3708	4572	msedge.exe	88
PID 4572 wrote to memory of 3292	4572	msedge.exe	87
PID 4572 wrote to memory of 3292	4572	msedge.exe	87
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89
PID 4572 wrote to memory of 2920	4572	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://filetransfer.io/data-package/otsHgOW8/download
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c32446f8,0x7ff8c3244708,0x7ff8c3244718
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2892 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11489386377026752849,14755234125294535117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
330c53ed8d8829bd4caf2c392a894f6b

SHA1
dc4f3eea00d78949be4aded712fcbfe85e6b06a5

SHA256
bbca8b0343812fb9db9b3c59655a18772c7c40bc77f497b89067a82d5e4ce8a5

SHA512
37674d84e4ea2079e8fe9bc45b0ea8fd93ffc8d206547835e4211046ad310ba3e5a397cf444b17a4322f9513cbd91bd92c0b106776b879cb0388ca9386ebd44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8903d794eab548e3fe962e1a2078a834

SHA1
89bb73691a2d63cff9e5a631f46f3a08e023ec70

SHA256
e214809210b2d622d2538c3601d4411380dfc60910580ba4fc937a0fef775af4

SHA512
24e8bae11146b08bd553b5d20632974d32d615e4b287463c34041ec1d7ac0afb42375862209a3b83fa99855e1551c97012294aac07a0080eadc2f013c284c5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a1089fe923e4351dd3fc4668b7c74d42

SHA1
da656b23d5259407a0a8936ab1ae2901999f2e89

SHA256
23805b6d88f453e4c507c9efc5507432eeeb938b2788c0768ce7ec3125c0cf3c

SHA512
27a9e8b8edd46e1b1fd0216267b24336429360cac3d3c6934a26c36bb2d84463fb7a276edbce79037a4ecaca031b08ad4dc9c4aef0be0ac8397b03085d02229e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
a8400afcae97152c099227bb8dff1ea6

SHA1
2a8dc7173c863653ee75930e7edd940852cfb9ea

SHA256
f821d97b99be57d5dfd9aafc3922b7f6bdda91738b38cee6893ed55c17ace7ee

SHA512
ba8cc50529b84a081284547c83bb8842f8df33a8ea35b24dd60b080423a5731f20dba904ce1580c82e6d5a54bb653b2746c20d9f076f8277187dacc3c3aa494e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
9f2966f66cc08c133d74a35c24f6064f

SHA1
16bc4be2c6550a8289e2e6dbf8a7961fe1341f3b

SHA256
a00fb0f61ba220255a6a7a33ebafa0d87a520085fdc5380b83a2cd220affdd03

SHA512
6aa8ead8ddce1730f883d1768e689ae69e15b6c2d32e12f978c46d5ce21bb635445b89f20a9419dea36c1d44b4a818df8cd069f96dfdd3e852d6560a12f9d97b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
f22a134b249200116c5361eae07a9ee9

SHA1
c069611f203498d65bd786b217b69cd1348edbf6

SHA256
aaa5054267303eb6ccbff64befb01b6a69a604db00ba5bd7648c2c869593e8c8

SHA512
3e7c1ff31eae1336591a1c74fcf024fa4bbe41fd26d73d5bd5c049be71dbf26538c454d818763429415735b42fc591877692ba6ca1976291a6003d530458dee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
b18d12923d7b848f75f53683d683a635

SHA1
a6a6a0d2d153c9e833e5e8b729d5e5d44e2f5cfe

SHA256
b6f86be63140b007482a20dddcf2be46d076fe990071c97b5e01da0447ad66f9

SHA512
31290ba1f5fa716c4d4a0e67f3589a887c46f2c867a0329823f59b022803ec2ea948678d21a772f6e23d948545d6a7c8cc0ed45404350ded3c2450c5f136a1e4

Download Submit