hxxps://sharefiledocs[.]online/

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sharefiledocs.online/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
2300	msedge.exe
2300	msedge.exe
2792	identity_helper.exe
2792	identity_helper.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2400	2300	msedge.exe	14
PID 2300 wrote to memory of 2400	2300	msedge.exe	14
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 1824	2300	msedge.exe	26
PID 2300 wrote to memory of 4044	2300	msedge.exe	24
PID 2300 wrote to memory of 4044	2300	msedge.exe	24
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25
PID 2300 wrote to memory of 3340	2300	msedge.exe	25

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf2e446f8,0x7ffcf2e44708,0x7ffcf2e44718
1⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sharefiledocs.online/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5594227644478140188,4944078457030986339,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84381d71cf667d9a138ea03b3283aea5

SHA1
33dfc8a32806beaaafaec25850b217c856ce6c7b

SHA256
32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

SHA512
469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
8c7443729bb0c41895589045bb003844

SHA1
23408ebe8546a73405d7f9c431cf00b99cc0aec7

SHA256
ac4b20ade1ea74c393782d4cca58f87c91fbbd1aab164c7eedfacc0339194a76

SHA512
b92d83f2d74f7a7778ffe9c9522955275f2ad1af1429896ee07ed6a945058b7678d6030adc68e0990c839f431515ecc2fbc47e138bf734daffac04885bf2705d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f843a86214b815bf92a1d5c33dd0459e

SHA1
dee8e6fd952e713f90be92ac440fecf946fa93cb

SHA256
0ce68512a11d6626e7d85363b1c846a3bd96c4231084553aeda45e2f66dda16a

SHA512
e4c65502c7528324b2316a722da81f48fd7db77aa6cb827d17bb42da9aaa469276cf0369e436a9514519ed5f894330afb59c3bfad45289ee6abcca4b81301bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
488B

MD5
0aec700e52f45ef2b8206a08c0f26caf

SHA1
6a3459c3406e85cf78bcdee42e6f9a654165c4dc

SHA256
fd597ac412ea0e40abc0b7259951c72bbd11190c97e20d53a0b4494fe7156086

SHA512
edefdcd1965c125c8759d50cd9fd81430d448938d701ca775537e47730afc938e44d87aaa6d62dcf14395b0b653612e6248a14bdae04346f84de7a1018746881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
332e50b70fe04d9ed4562f425b49b528

SHA1
45e269e8d8fb517cae0493cc80680a65531da581

SHA256
437e47a3b2551a1f41b31772342ec0b245e2ee82e46271229876f79259023f9f

SHA512
552ebe48eb91ee0f9810a830dc95454c95d6a031c292f75685bf27600b93d5859285d85573d5ee2b09a166153dca11270931f3046f477a6fb845ddb0a78363e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3b1510eb263fd45ae847ba59034b32d

SHA1
8b98eddf64f3d3ac6a8bf738332f98ded97dde4b

SHA256
1b1be9de6790fcb73d3b8285d258ecd4e4ec1ef6d4dc5a47614e78f69844ab76

SHA512
688f75968bfbc207c95c7a66805c714774d9614362cd1ea33b190ad2e35784f0c2b80fe3692cdaf28b59d635cf2f8d06fae18c9d0145bdd5360d67c9dcef2c6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
091077f51321c7a09049e10fd56bc972

SHA1
e05ce3bed1dff64475ecc8f7edc0dae99bd71659

SHA256
d012b68ec1bd5f4f3c1bd8060a780edaff3ea70649c83afad89fac86352b324f

SHA512
77b833c7ac111286b29ba207c1d99715569355f22173a876b8e4996950c05257129d1b7cdb8e6a34a15032c7dec9912e242168d03da8d113022e21d0e67e1507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
50e2cd5a5124fdcf1eafadd4e0043ae0

SHA1
63d754c4ef88f04f3c4a4ab1cdfa707a3a759889

SHA256
a9691d9f0d97af45748742110d6b40556aea540682d0086689eb2921d670d2ed

SHA512
0952828e7492e99abc0f1f716d609ae5938ee5c5d6d397518b01d99731a65c634bed66e9e8444299b6f2d0c0525b85e61bda3442f5727bf5fbe8b410a5c60f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
35f77ec6332f541cd8469e0d77af0959

SHA1
abaec73284cee460025c6fcbe3b4d9b6c00f628c

SHA256
f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

SHA512
e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
6772f95c3538e2d0d6d285aa98d07520

SHA1
b825ed787d119cb6ce7dabf7ad8534092d32a986

SHA256
c2b9ff32d569de484bfefbc1e3772a2417eb2727fb8086cb571528087ddb8d9d

SHA512
10e2bf814b4de7f5c0a90e44c4c19f4338077f59bf52ed7326ba2a415972a25520d0e8d8b0c0d0f5d3490bcdc1997d8075f3a32bd07bc6a169dfa058c37f9ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5876c1.TMP

Filesize
371B

MD5
ce550421c84b1a5b2d81bb0d91b9b946

SHA1
6631c1b144f0e2039544947f1026f5f14d1c7614

SHA256
3256c4ec25863eb772be240daff1219488b3254c2bec6cbbe7b78f25a1877e72

SHA512
7670da48bc48a9534b9f5b2dbcfc360b891d87e45bac130570bee5297cbcf240abdaf952306cf6a6e2c2eb1df4f69897541642ae7510cb5afae5bcb277a727ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e70e70dbd9b05e4a7f5078604bc34336

SHA1
070bb880c379d1fa8bee8ca1657f582f7109f0a2

SHA256
c2bc4c529f29d1a4f965576234f18820a594dd05d5720244c400b4d768bf619a

SHA512
e130d11fbedf7fed96a52cf2d994f95fc98542d91128e35aca2815f79e9b5de8eb2296d42dcc0a9e35427940ec323bc93f1567f54e8272a37aee8763ef93086d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
18c56ee14ae85853b0f3fabdd1868b00

SHA1
27436ab30d6607a9afa46d65676acda64b64e6b3

SHA256
41966e40230bc56da25ba492d07f75569360c92a16483e0fa8ab1ede69a71311

SHA512
f43858b904291ad231fa856fc2901e299d1b102140dced8f4ef3a9d6cb30178baf5bcdbdb15ab403f4f1b39eb843261b753bc38f3e0f8e01b34720893331a69a

Download Submit