hxxp://google[.]com

Analysis

max time kernel
70s
max time network
84s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
03/02/2024, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "175"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
1528	msedge.exe
1528	msedge.exe
3140	identity_helper.exe
3140	identity_helper.exe
5144	msedge.exe
5144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4120	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2956	1528	msedge.exe	79
PID 1528 wrote to memory of 2956	1528	msedge.exe	79
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 5796	1528	msedge.exe	82
PID 1528 wrote to memory of 4672	1528	msedge.exe	80
PID 1528 wrote to memory of 4672	1528	msedge.exe	80
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81
PID 1528 wrote to memory of 4804	1528	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb9a943cb8,0x7ffb9a943cc8,0x7ffb9a943cd8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14781768586010161036,5945569601631414502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2268

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39e1055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0307d75488a9def144d0373178e421da

SHA1
1e4351dd4a29b6340913848163b4df62628ad06c

SHA256
9e1bd506806510408dcb9d5e1eab6672d905780282361f2b9974ab9a9ed1ab9e

SHA512
993dbb0491352352ca89542922df735fc7b3cc0d14a4790f106c25ee9fd616d0722151d05e045ed5863e56b128c3308a561b958bbf5fe3bb87498e8a6d12a50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
2688ffa2ea8ab5dcab53a720ff7a7ebe

SHA1
e52bb74c3de4bcf348f1bdda13646ec7ba697445

SHA256
58e16ce9dd6c6ab0b7dc401b6c7188fd52169ed7cf5ce650e99c26dbd4db39db

SHA512
478b80d57225d556a5923bb59cf87eb52eb0f4d275e15c7856b69f95a8d822e40b73df3855822d38c758da91e1d8c44066ab6796308ce2a7be964607176389ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
d91be20136a56637d0f317cee863b911

SHA1
74f5d5db04fbb6e3d5509db003dc1e69579d8a1f

SHA256
f72e950d787a45ad73a1542da2fc0313a106092f3d5c74db66a7d87082a5e322

SHA512
a5427978170e6e080ca7f42cb26ff0dd51694b09a01ed175b0784775d97f5ad5ffec324b0a1e5fb8bfe60307e693320f8685d312544dccc74f504f118f1cf623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f05450653c9466ba0f4dce7195e64d9

SHA1
ad4970068e44e8eb5a8447fe9da0bbb0d1e261bb

SHA256
03f9656a5264b97ba7e329cb4d679feb0e620805b8a7d5bf7829b1e5bc0b3b02

SHA512
68ed56bdf1c7fed525010b6d8348e54dc78c233f13808e94dc4a6a1ccb4a5598f1b428b2c6113ba833f3bb9fedfba71cd4e4e877a0891b2d905a8dadb2e2c190

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
611330c89e5742509b5947bc6b0e0ab4

SHA1
a341399d0f702e01a82a634f7cbf5324637b0ac0

SHA256
12eaff7f42d1ec78ad12f34c9d9d317834fc5d816e5edffaea993aa6a156bc1f

SHA512
20229524816f0e383c4b9bbea956604a6189a9663b45008c3353b565b8ae351c8720071f4624efa3f023aea3a7cf53dfd272321f9457ff83c0d6c0942ce4e073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
2824d5298d78e980721710d775506715

SHA1
68e3454af1d9b9f54fc9b823b75ec60b1135ce5d

SHA256
b76e96bd56d91b109ef500f843bec5ae5f26941127e40353ca19ab79ed3473bb

SHA512
007986e809542f621952d3cf92d09e5b1e22f70b444de7356fe10a5fccff68391f7ec27b0e66b28b84d834f39685aa4f17ce3a9f7072ac43620fab51a435fc13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
941e860b7a0f77dc20acbc41973257a1

SHA1
b1c5fd6a957b8b02b3433c566bcdf37acc00a7bb

SHA256
8265b37377e1f0708e64806d2820b15213b8884322d225ce089191845bdb77e7

SHA512
8e7d960125876b2416580ca6a2776751a25953b6fb195407a9f214b51378aef422bffdffcdb554e67461dc71e6556fd5e7a95097c91bb65b3307c8bcd0149e3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
5685e0269c1c7491833d4f01504c32bd

SHA1
260dc46daf8deb9e60b97f153e2434263205cdeb

SHA256
646ce02b5e22166664a09bc3c0f98b477108e2c670370174cfbe7fc6b8661f96

SHA512
4c54134e25dc39804fc3d11c6a8408097b416a66519269c0acc56311ca9d4b326d8650e887e992f73967ff7b46f4579c2dbc5ed2aed1ee6796f4519b8736822f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
5d600df82176d86e393fa6c4eef40e14

SHA1
a982aff582e8b7f375cbc35404ba1f0496a6bd37

SHA256
343e343adeb6fa9e4b70b40ee3692ee089964d551c3f815c13910660e9a6b3e7

SHA512
135513a52d77e8a04d93c30fcfa8f4ce6071eabdc1a07bd5f39b7a2162e95808bdb7fb175d1fcd8a4285c94839e35d72241e41d4a6f7f5b011fba530e9ed0019

Download Submit