325cd8cd74165c89739dc34ef141db4dcbbe849fbf63b952bd13f080e8506f8f

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

homepage.url
Size

98B
MD5

cdc78c48a2c7c0be23b53b4a573551c0
SHA1

d6fe0c4e27726cec8b1543da5e8de9d5da7c8186
SHA256

68b749a20c53ecfb067a38db0b9f658c6cf38facd100641c9bbc70ec7aecb96f
SHA512

4b2a69002d2e8217d5758f1efe101147f23b30d188f893a42a0f06367a3d2a2d7c359b6fda085713932d387f4879758bd004c3c7df36f3ad8eb2c3b8dcbd2753

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4084	msedge.exe
4084	msedge.exe
5212	identity_helper.exe
5212	identity_helper.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4084	3680	rundll32.exe	91
PID 3680 wrote to memory of 4084	3680	rundll32.exe	91
PID 4084 wrote to memory of 1792	4084	msedge.exe	93
PID 4084 wrote to memory of 1792	4084	msedge.exe	93
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4800	4084	msedge.exe	94
PID 4084 wrote to memory of 4916	4084	msedge.exe	95
PID 4084 wrote to memory of 4916	4084	msedge.exe	95
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96
PID 4084 wrote to memory of 2388	4084	msedge.exe	96

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\homepage.url
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.mailutilities.com/adr/?adrmnulnk
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff759846f8,0x7fff75984708,0x7fff75984718
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,3355361164330749132,8452665872383227232,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3020 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
198KB

MD5
06d38d9bf028710762491328778f9db6

SHA1
83e1b6cbaad5ca5f6dc63453da324f8df28de193

SHA256
91558d69c027808e375e11c80166dc6ba245fbcfce715c9588decc55b4a33dad

SHA512
b197e5f92add72688396a07246ee9842a3b0de36508aa57f0254531cb109c77d0392e00ea28e006f9fbab1b8fee9b333998946de47ca7526b631e8c810780781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
75ecb7e6fd1bbc21f636bc2cde20628e

SHA1
f3f286c2a4e46f7e06166bd12d126e4f3ee510bd

SHA256
7909b9c12a5a389c10b456c016e5c581a4bb8f5673d810ce7ef753400b101723

SHA512
77b40618a2aedfac5353b579e931a5825a59d3fdecfe8258594f8baa152c51e1b7353440c663498fc35f293aff9ae6da48459e720e2aa0703a1bfca2db4aaeb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
925c2854aacebd902c0b3d7d81fbf9b5

SHA1
1dedbcee2cf6e4627f5ed2c30c7a6d6bab11859f

SHA256
e26e4d1521d31bf1b5730adaa7ffc6335852767fc997e12c73c78e184193de7e

SHA512
95d6cbb06f8284acb5a5c71e1408e6aa3f6392e1c36db8edcef660512f4418e8ae8706eda4981c72ad57d60c1606912c7acc827b124cad99c7ea415e59803a4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bd9fbac164cac9da29c1dbf5c9028bc

SHA1
04c981bef41e55a2eaecfd00920382e3b0ec5d3e

SHA256
1a08c908eae86d2b6e82e26ec8b6ff783dc6c3c647d905a4f69ee05bf840e159

SHA512
aa64caf23d3e389783c9333f6a85e94795ffa4dd9af9757ded9fb48fc21e97ef9f57fa0354fe114e6d97a2baf3c7b4efc1aaeb0e808443e48dec3879fbc8ccc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39714d46d8bfc16b22196e182320adb2

SHA1
f78ad72be6baaabfc270fa7067d604e922c6ac91

SHA256
9f2042b46e48b9643c9733a49408b72d1fd3d2b3eff629546908eadc3732c8ef

SHA512
fdd241d0c0682763559be3eb60a478007b82baabbd19f81d886b770711f889ef9385acc3dbf5b4f4d0612900739ad02b07e4894d0e15580e3178cbc77c78f896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1eaba3feebbea7958557597d3e0980af

SHA1
151678fd71109c56558d0b06bca7c8a72950b589

SHA256
617f92fbeb783b31a9a9d7d8ff3bf893ad949b8ad2423fc1e09c6d8ad19da0ce

SHA512
e5708675993f45eda58cc91664858a7b76a77c8db29886dcd51547c6bb916e450f361e7c777f0fe626ac4ca2927cf47fb5900341cbdef3a96db2812953e0589a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4715c3ce54d8cf987afd016f9684811b

SHA1
e1c79c33ff7439105dec19fe579f0e7abfc59177

SHA256
4c9aed1f19282f7176369ec2236c0b6bd6fe19acd9841b545406c5637e483d83

SHA512
290e6969b07e4ead8a8971501836f9b97c375a488beb0f939e6829f40b6bf9f568231ee95c9b8d1bd5c699b08720cd9a9d3bedacab65f740fda97e9259f7e3f3

Download Submit