hxxp://email[.]csapp[.]cirkle[.]studio/c/eJxMyT1uAyEQQOHTQLniZxigoEjjewwwyCuvDQK2yO0jd6menr6aqgdyKDlpry06C-DlM9lgqKCJ2WtUxXofcqtWa6AAGg3LM8Vgq2NGX0BF5RxGhREbuFK9QxUEqLJojKOc83XxsfZdzy6v9Nx7LGF_hHkI8-iDP2-aL97josK9NZ6fto95f_F7_ypnopWJVu53JgHql569H6W__wIAAP__Sxo9rA

Resubmissions

22/04/2024, 08:26

240422-kb1tqshd57 1

22/04/2024, 08:23

240422-kagpgahe2w 1

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://email.csapp.cirkle.studio/c/eJxMyT1uAyEQQOHTQLniZxigoEjjewwwyCuvDQK2yO0jd6menr6aqgdyKDlpry06C-DlM9lgqKCJ2WtUxXofcqtWa6AAGg3LM8Vgq2NGX0BF5RxGhREbuFK9QxUEqLJojKOc83XxsfZdzy6v9Nx7LGF_hHkI8-iDP2-aL97josK9NZ6fto95f_F7_ypnopWJVu53JgHql569H6W__wIAAP__Sxo9rA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
1272	msedge.exe
1272	msedge.exe
4216	identity_helper.exe
4216	identity_helper.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 3596	1272	msedge.exe	86
PID 1272 wrote to memory of 3596	1272	msedge.exe	86
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 1788	1272	msedge.exe	87
PID 1272 wrote to memory of 4900	1272	msedge.exe	88
PID 1272 wrote to memory of 4900	1272	msedge.exe	88
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89
PID 1272 wrote to memory of 4156	1272	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://email.csapp.cirkle.studio/c/eJxMyT1uAyEQQOHTQLniZxigoEjjewwwyCuvDQK2yO0jd6menr6aqgdyKDlpry06C-DlM9lgqKCJ2WtUxXofcqtWa6AAGg3LM8Vgq2NGX0BF5RxGhREbuFK9QxUEqLJojKOc83XxsfZdzy6v9Nx7LGF_hHkI8-iDP2-aL97josK9NZ6fto95f_F7_ypnopWJVu53JgHql569H6W__wIAAP__Sxo9rA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3a3346f8,0x7ffe3a334708,0x7ffe3a334718
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,1775260619315251194,12515068107366623679,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e2f0fe48e7ee1aad1c24db5c01c354a

SHA1
5bfeb862e107dd290d87385dc9369bd7a1006b36

SHA256
f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9

SHA512
140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7e0880992c640aca08737893588a0010

SHA1
6ceec5cb125a52751de8aeda4bab7112f68ae0fe

SHA256
8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2

SHA512
52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b9b38e47beb8d3474d943a483511984a

SHA1
7d43f2c608f00523387a79fd768dccdc15cd074e

SHA256
e9736e5001dc51af45603855ad5787ec17b29e5d6d0e508183c15d8386815842

SHA512
efb5a97022396ccf4fdc4000be0d2ffacf03fe9574051163b50cc8526a51eb727e2896813d6b6af6620892b3cc7a82272846cff8f2d018c57d69b82169b5b4b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
554B

MD5
2c4f595fd2fd49a35e7e2690d900c290

SHA1
0c743d855fe1b5e4d1fd21d58cbc047cb20e025f

SHA256
20309b8a359dae4bf79a8fd23982a7a8292f11676bf3d81874d00ec0bb5b7ba3

SHA512
4420697fdef908115e6374f72ba4368ddadcbf5a48b4b0c2fe1b9ae109d68289ee6d8f048cbe337c908d25856fa2f96f50619222b451ce6635993b7bd165f36c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c47f98adc70eb06fe3f96ff0f9a0ce3

SHA1
df4a0f3ba5749f8748aa4c31d74e52f7214254cb

SHA256
f151c5d201d59ae2fbd083c106bd00f6d421efec67a01f36e7bcbda7ab21ff62

SHA512
bc98976901e4070d41728456dc506aa8145afcde9d7ebf689aa5e3c775a604a2aabee2e28f03911f25fb96a3ea7249c69e016bf441125ce680e67fa842127fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8af56326388263d835a711ce7533156

SHA1
69e9dd5ec283e0f6e64e9031cf9ad9ab4bfb11a3

SHA256
c48e23760c1193166079b58fd54aa2ebc93e4510a51de47dc23d103ea8f71481

SHA512
79950a08f3ff1691c5cfb1329347b5784dddb33f3427efd603d636cff1d0708c8881a6233d757218fc4550e7f2a4b200bc4d24500e4f4258a9299fb60a2bcf35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e74c6baff9c2b3baaa15eb8b1ddde93

SHA1
2eb63b3f594b12c28c5b19ac85b15078464bf658

SHA256
8aa968ed3ee71f991db52d730b6987b31578018ab70e4a0a08c72b9a74186e82

SHA512
18acd844b453a371d1de5f963175eed4f36439ae37976b80b887fee95c6a5f6a58dc323fe0979ee773128fda1c817d5f9c00646dc22e22a88821a9b75511adda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9da1a52b0730dd56ddf150c137d80e1

SHA1
036bb3ba5c6a2e9fc01bc5c2a7dd5fe9775b5366

SHA256
f0b0a11d1306bbb1559f3f36a0034bf101ba6b756970acb9c7880e00c72f7521

SHA512
f7247f41fe46ca3dac892b04236ba423a814daf086fa33086abd56f500fd0cefe6cd68a60198a51f478d4b85ff99ed60eeb6e1fa9c2b5fa4bc9edda4684ca3c8

Download Submit