hxxps://flowcode[.]com/p/H0Pw82sec?fc=0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://flowcode.com/p/H0Pw82sec?fc=0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
3100	msedge.exe
3100	msedge.exe
2060	identity_helper.exe
2060	identity_helper.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe
5128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 2668	3100	msedge.exe	82
PID 3100 wrote to memory of 2668	3100	msedge.exe	82
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4872	3100	msedge.exe	83
PID 3100 wrote to memory of 4568	3100	msedge.exe	84
PID 3100 wrote to memory of 4568	3100	msedge.exe	84
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85
PID 3100 wrote to memory of 4384	3100	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://flowcode.com/p/H0Pw82sec?fc=0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe189b46f8,0x7ffe189b4708,0x7ffe189b4718
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,4145970566787282860,9722992483127065190,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
81e84857ccfe41163792d0b66ca26900

SHA1
20b31b5fc726b4ef92df65a39401917dc8246e14

SHA256
bf67d2ac6d86e23f40353f76e26ffad8d62764931b365382bf7b6c2a805a7899

SHA512
7f8f92b14e704edbde22197e698f10e0962ad56061e4d0d39b87df78ad0b8208e72948d268b7bb84347c1a43af26cadc8fdb02f46c20d6ad9648c12199093f68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
619B

MD5
3f622ea0fc49e6c02d116dc8f0be8734

SHA1
b01c3f519ad15986e9cf7874470601691e9e2ac2

SHA256
8d80097a042f608e26b05eee9c5b76ac9a46dbe1373986e8cf9f9838c128f5b4

SHA512
9cadbc5f04c774bc8c1a7623335ce1de48981671cc06761ac49308d956c9769b63d108ac463479d1a9f0efb907857ae2104e74f8c619b421c63507af66146c0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bff492926ce23cf79a6abf5332174016

SHA1
49a7d65d26ad028363cf81bd937008eff6df6076

SHA256
9eb51bee94ba1a932026a2c637c785173e003a55544a6271124d04ca4a5a6bd1

SHA512
3a77eee798b969f98d5eb47711102ffd0a651da87a186be0ef00f94077f54fa7cdae4d377dbf71310e6805834530ac9b2ea90019225081857859c67e4ec467d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1221d1dacefcb8d8d71138dc07531aff

SHA1
e9cf99c431aa4b7574d187469230f773a1ee50d9

SHA256
7bb26e731005ae22f11dc1f1b3e784bafcb01ce4fc6011fcacc25c0849798fb7

SHA512
e0ac0be0173a32fe10d58d60e859ed78257bc872ad2b0e68d1edc8cb083bd1063b9521477139b0d22b9cf05d40c19b3e87b010b9f502dddedd891d6aacc7a6d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aafc512631233456917a34afa1820108

SHA1
a6cc730a74eff0b4560ae9360705e0b4fc6ec2dc

SHA256
8d7c634aca53519df81f06f832fed828f784dc3b6bdc8bc9fde08ed4663dad25

SHA512
29d4cda5373542bb949bfa447d97800239ed4847a29f19ceb667dcadaabd11e905d1e4978b463608d6be88209ed1fb365d421eed8e079acda2053fe77a987506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b6bd5f1907382cf13d79cd5af0d5bcc

SHA1
dd52e9c44f1e10777f5fd53bc2e5fd2447ab262c

SHA256
f5e2b0ad0c95014cead5e1b2be3c4edbc678a52ab43b227ec44a6c8f16d94787

SHA512
2d95cdeed2c0b654947e4ae95a52aadac86ba9516489622d7179f8db63d4907b528fb5ee25c5d1f5584fb82ee63282dc5196e5451f48ec79d62c450f7186328d

Download Submit