hxxp://getlo4d[.]com/Bitdefender-Total

Analysis

max time kernel
1166s
max time network
1185s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://getlo4d.com/Bitdefender-Total

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2620	msedge.exe
2620	msedge.exe
3852	msedge.exe
3852	msedge.exe
928	identity_helper.exe
928	identity_helper.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe
5436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 4860	3852	msedge.exe	87
PID 3852 wrote to memory of 4860	3852	msedge.exe	87
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 1800	3852	msedge.exe	89
PID 3852 wrote to memory of 2620	3852	msedge.exe	90
PID 3852 wrote to memory of 2620	3852	msedge.exe	90
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91
PID 3852 wrote to memory of 1520	3852	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://getlo4d.com/Bitdefender-Total
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb605746f8,0x7ffb60574708,0x7ffb60574718
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8975351684945556153,10210333791759654064,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
73c8d54f775a1b870efd00cb75baf547

SHA1
33024c5b7573c9079a3b2beba9d85e3ba35e6b0e

SHA256
1ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94

SHA512
191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b206e54d55dcb61072236144d1f90f8

SHA1
c2600831112447369e5b557e249f86611b05287d

SHA256
87bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b

SHA512
c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
5e05cc7d88792f9d3eddf2d9d2e518c7

SHA1
bde759c6acf0e94df21b168adba05529764bb7f3

SHA256
ec4e840e184f71d000538f67bf685548cbcbdfad73602c8a117dd7e826aba1f6

SHA512
6da7512326e0bee6c0c7aefacbc0891586aff5179daaec62f22a51d46a48ad248507d56305db9b2b27989610c785dc6cc1abda6380d0b5c87600d6b43370116c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f393a8d7cbaaeab168f5a76f015c3cd1

SHA1
73f2f76aabc1ad2463947368f2981cf05c0f3fe2

SHA256
7128c122b7c5a61aa969f22f888b097a06a0ce0c6d078382cefd1ad9a534b940

SHA512
d21124e82ddbd81b673aa05207510488efb972b2dff09c587a9217cba9c356150972615627ab59e76791ef0f2f90357c4c22a6a80c24afe113a6e4568c224f9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa1f83541fe3c6ffe3c8cf3a31974dc7

SHA1
6c255c8506b6bb84bfb699c53526baa49ad55b40

SHA256
b449ed50ad6946a999e3052a1b8a8f2cac4bc40a031f1d4669205477cf3018fa

SHA512
345d584f0f7e5fd051f1e081f9ffab5086ca35e60a6ea8e2dc1d7bce0aa33e2efff4b3a91c0f3d79687aab40d4270c1ec0c9b32a523bc16bf3fa483e6c14f522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
a498fc884801714d4ab05414d801cb56

SHA1
c5d2e7c4dfa46154179f40f66bd0196567f0fbbd

SHA256
7e8a9618d53a087794e8a6a36f4df2665b9381133c3ddb912ad9e80fc429af0c

SHA512
5dff9422ca310c10eb7bbc7117784aff274af2e945273f51df567614b4c8a563bf7c0413f39e543f49e7aaef2158b7a5514358d09d3170bb4b64072b54c0b544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c870.TMP

Filesize
48B

MD5
827e20c28a7531e1bac5d6a594a19279

SHA1
a851cbdd1ffc84417d7132198bdafd115b559212

SHA256
bbe879cec4eda1bc3dcb80ac4738ba2ff9dc1f9dc80c376fc8eab5e5f9c07f88

SHA512
367c657dcc3dd94d07bb3524e023d92df1ea61b0b0a26dddbdf0f90ec332c0425369b9fdc24a0f7de884f73e19e69efbff12c1af9c4790977c0f3e63af79451f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be07630364fdb93ca45ec016dbc77c6e

SHA1
f06228092af7d1d59600d42ee6157acfcf706468

SHA256
ca4547a72f90df7985f59515a7d09d1539e3e721e696a74d07733b7e876a05e3

SHA512
f1f3554f4081972329aca235b2b9817ff04b96e475724e9a4b2e8e7c51c05e3bb220d43344499fed4d19402222c6840f668287bfe80ff7578743438c8a02edf7

Download Submit