hxxps://www[.]facebook[.]com/groups/190255011326571

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.facebook.com/groups/190255011326571

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1448	msedge.exe
1448	msedge.exe
680	identity_helper.exe
680	identity_helper.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4224	1448	msedge.exe	84
PID 1448 wrote to memory of 4224	1448	msedge.exe	84
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1884	1448	msedge.exe	85
PID 1448 wrote to memory of 1120	1448	msedge.exe	86
PID 1448 wrote to memory of 1120	1448	msedge.exe	86
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87
PID 1448 wrote to memory of 3804	1448	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/groups/190255011326571
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb19246f8,0x7ffbb1924708,0x7ffbb1924718
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,13445321754825914476,11565437049291088563,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
09e0797c5c7d872995c149172c2d0bb0

SHA1
54f636d949da38dfe2af582c0ab4498c834be5f0

SHA256
aaa5d62936d444678a379680e6eec302ad9ccb0aa2c3f773dfbe881d3fc40742

SHA512
297c9cf64f8b4622c385f1d932adcdc2d117eb37a87fb4e70874430eb99773b3455ed71b95173bcc19152ad058ca9c89f1ad5a8ea1dfde23d0742ac5cadccce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
398B

MD5
ef38235b738c75be474e407925422843

SHA1
08e5132051e95367daf1af589e9426fd219dd95d

SHA256
ba991d1ad86d0420bf56a926fb1f1548a0f55cff6464b5ac282a5d35e2b7c6d5

SHA512
50426707ce90a4bb0a823df7726cdf821fd577490fb911f399560e3739de77e6d993dd2ca5ac31a4a996a7eda281638458fae1112cdced28f18d9fd4b11cb106

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27b63f17b15e71833860bb0555967ca3

SHA1
adc77cba2f4ec32e0e702607a34ed9747b332e31

SHA256
f8383eb45653369d86be693317a83be3dec6bb5a65536a28a3f488aad5e7a808

SHA512
38b4e09aa9ca651c70d0bdfd86f659f85bedbb25015dedd45989b6e9a2335d8bdc99d213942ed55b357e4041183b9a959a437096c9deb1948c6bccbb05c038f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92d1055d348a35098dfb02b70a4c47dc

SHA1
cb48bd6685fa1583af45d678f47992fea4cd6842

SHA256
87981d7ace255b0e174abc20f328f29735f8a5078015fc947be3a9532626a84e

SHA512
5a48e1e7dbc307fda95c3053660e26a49b34d3f9a0be5b6e16ca58cacdc65fe8bbabda426e9c3e04ea171fcef6ed997a135e88fef6a98798132ac5c07125112b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
cdfe85a0af909e866a746f1db58eb5a8

SHA1
42f8d8faf44571ae70ad45df86640632350f4792

SHA256
064f4190f651413d25f16349e45184c952cb0063f4669a96cd458683f0282c2c

SHA512
2a03cb64ff3718856391189a3232e8029fb1881239b3cda3ab8dcb5b9b27898e7b2853cacef2529211b7963cdc964d79678cea1cf0878d732d8105787009f52d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
60b48cda359a2d5b872e8a010b685d54

SHA1
7c10059ec166e4d6de855cb07dfa62a84428a0a5

SHA256
4d8fe49554532b9bab4c8a1e08ed4d24d78b4b15b42a1ecf075eb3b8749f1ab0

SHA512
1b7956be869523f8182e7d03ec01b701548b8a42d152c88f917c03603e49ea7edb60daea77cbd07af7f7f2dc2c043aa1e40c033419c0ed9c29b33dadc0cddf16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
afb71832ef5c0f8159645909f782af72

SHA1
3e8ac8829d2bb801557ae3ba3706777582f5c594

SHA256
d94c98c10754301e78bd1013aca679a6599da4f9eb9e2e43e67909b1b5c9f6a8

SHA512
170f0626f0070fe717472b9ef424e8e3e2225f062f6eb42f5c9b7cdbdc40530bc3c16e7db7860fc5c2df577fed75ea6cf839d07c22f00574b7f117e241b4587e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
8c7991e6dee3c52082a230ec79242f96

SHA1
87d59e1a03bfe13e942b8d8731f015d1ad4aaa23

SHA256
7270e1c4a054f6bd84db35f4b169eab4f5a7f09cbf4683011c3b8a4a8147227f

SHA512
3cb513d6efa0c3822042f384a3a5d319780643eaf5c670ebeb5c1cd638a495d97e5cee03a6948d8a86a9eb1c15c1e02d312e2b960d4842a27d398143e1503599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57974e.TMP

Filesize
705B

MD5
d0d5d0ebbddd5a223a45999156517ebd

SHA1
d62ffa3647dab61485dc9d6e6699a46ba82efabc

SHA256
3cd530d4c0c60ecc06072b217e6262be2f474ffc3f275f3564af76104e112882

SHA512
2dbbc5ad623b54294867de9408d62f79fca1c3bd750a141fa13a815876aafdf58614c29c9d43cb6415e0625d086f34fc30484c4d124bd9b654093719629e2fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ead6b9a3e5d0ed206931d2e6fcb653a9

SHA1
c824cb75ebf812bae95ef9e8f9eac11e58b57a94

SHA256
1af39fc8e1f9c780c33270330e13edfad3492a39b0ee22f56e0b682424f12eb9

SHA512
bcfe73c386fea75c38f11976382b643b68febbea0c34f23e006d62919f0b04db20cc05957ba8dc41a3b16c3b09fde7d88998c0e010527297383cef7ffa67a65f

Download Submit