hxxps://cdn[.]discordapp[.]com/attachments/1232825429614788749/1234339046864719973/DMDGO_v1[.]11[.]2_Windows_AMD64[.]zip?ex=66305f51&is=662f0dd1&hm=eabf8bde52498b7878947f5c1466f1d69cb39aa27ea5f7dda8be912eb9fedfe6&

Resubmissions

29/04/2024, 03:05

240429-dln5csgc64 6

29/04/2024, 03:03

240429-dj6avsge9w 1

Analysis

max time kernel
121s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
29/04/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1232825429614788749/1234339046864719973/DMDGO_v1.11.2_Windows_AMD64.zip?ex=66305f51&is=662f0dd1&hm=eabf8bde52498b7878947f5c1466f1d69cb39aa27ea5f7dda8be912eb9fedfe6&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
1824	msedge.exe
1824	msedge.exe
3572	identity_helper.exe
3572	identity_helper.exe
1876	msedge.exe
1876	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 576	1824	msedge.exe	80
PID 1824 wrote to memory of 576	1824	msedge.exe	80
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 2748	1824	msedge.exe	81
PID 1824 wrote to memory of 3144	1824	msedge.exe	82
PID 1824 wrote to memory of 3144	1824	msedge.exe	82
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83
PID 1824 wrote to memory of 8	1824	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1232825429614788749/1234339046864719973/DMDGO_v1.11.2_Windows_AMD64.zip?ex=66305f51&is=662f0dd1&hm=eabf8bde52498b7878947f5c1466f1d69cb39aa27ea5f7dda8be912eb9fedfe6&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffaaa4d3cb8,0x7ffaaa4d3cc8,0x7ffaaa4d3cd8
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1900,3880150914920325642,912726855014376016,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\TraceSuspend.bat" "
1⤵
PID:692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\TraceSuspend.bat" "
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8d5e555f6429eb64461265a024abf016

SHA1
05a5dca6408d473d82fe45ebc8e4843653ad55af

SHA256
0344fd65882ba51695a10e1312e65f08d58afca83771c9d545e181829d6b5ed1

SHA512
be5edfdcda1ba0db9fbab48ee1b643f1b03821e24048892d18033094fec14171035179e987a08dd91a1c25d91d9256837a4105f6765afd225a868f3e95050b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5710c39b3d1cd6dd0e5d30fbe1146d6

SHA1
bf018f8a3e87605bfeca89d5a71776bfc8de0b47

SHA256
770d04df1484883a18accb258ecfa407d328c32c0ccbd8866c1203c5dfb4981f

SHA512
0f868e4ce284984662d8f0ff6e76f1a53e074a7223122a75efa7bb90d0204bc59bee4b36c215d219a03707c642e13f5efce0c3c57f46659a0cb1e7fd2f4d3cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aef04d1fa6b9d07e81f72381b62c5793

SHA1
96b5f9493b14dc7060309d75635a4855b4adf65e

SHA256
2fe15266879d44610bda3736b81deb4b2d0ff3171963390d6b996ef909b1423f

SHA512
43c934b6e8053086fc982a8c94a9313adabe469abf2acd56de3703a295f3d73a1520d89b430f9dd9444e213cdc865b34b2cb6b5a745459e6ddfb2be1720976d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f68a8215200750f69e06a6f9ccf21d10

SHA1
9ad964171cc93dbc8bef73b9878fc89b11d2b8ee

SHA256
70fe7928533929d3248e4b076b7ebb5df726cc3f64e7c72fe32d42a90360ce12

SHA512
7bcbd0026f2d932cb1ced390364ce163e9094ea69caa15d7b3222d10b2842243978061c30e1845ce9a0e78fa56d6f24ec817c31bef0ccdade46f09f0e5971b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
da451645b90a5272e8bb476ab81e1bf4

SHA1
23346a6c1d91f97ace8a40301f987ce837d167f6

SHA256
d8efca2d2f85ec0e0c9af57f693277c381fcb040f07c686ae32731b55719edf0

SHA512
d4513bdeba31d573d4279d1476d59082453715feee76cfbe341242afed4cdc6c8e85a70d281e590c8733c3d30f8d6b2adf5bbd6943b3713c8560a3826045b41d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f46d588ec483325d05b395ef888845b1

SHA1
d329568f16930f167a67ab646fa6bd373625087f

SHA256
26fb58ea661802b15a95d865f6c8fa3273b78a2b93ff5938202cc7dfbd258da3

SHA512
b83b685c46b371f42aa1ba081377ddd73e128902aeadcda175686f356b913bd3f1c5711dbb6c9326bd4951f7f328172a1a637b90af39d3f599cf0a826896e1b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
22bce5fd93e670f5da7d9e685ad97224

SHA1
bbb49ae0ed2e8a5b264703382947e96f63ba5283

SHA256
d62920feb91db83797428fe386e6d86b8ab76689707af6444a24cbe84f861641

SHA512
5812aaf00b9984fef0e7763aff33312fce5100433f2094301802c7e19b602ae0eb6b88ff496f0afd152390b27225043e83febc941d7e85bfaf433c33d15fab7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
b53a31ac1635ef1817f75c8f317869f1

SHA1
222f2451ef8b780910a25f5bc98364147372ca04

SHA256
760a99f1eba3c83a4048eecf767054e9602e6d388726c7fa27263c201a63b700

SHA512
8545010dc9afbed85b8a638af8619e87da7089e01c20961b1831268393b4dc299641b7edf65dce3dfa82543433b010a0acf091cc8bec26aee424dd644de9a6ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f75776f47acfc4004bbadd47d293c4ec

SHA1
0d95ba382d8ea7a495ae216fec0c496412eff452

SHA256
2cfc9d3293476fcd68b2f6fd3394424f189331e5e89e772fbeb95fc2e821303a

SHA512
640ea91969d6a8c6f6092085b270237accde058a6a7306886036503f7159beaa3bb5e46fdb8b98d6cf316302b459e834167a6d06ee060aa804bb134b4a275c7c

Download Submit