835a4ba84850cf50c58b958c271dea8433706f88112812e658239dedd2a9bbaf

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Abyssmedia.i-Sound.MP3.WMA.Recorder.Pro/下载说明.htm
Size

2KB
MD5

e31159167e6bf59f83538a79942a1ba4
SHA1

5f4627b3915344a2c2137b078c9d103dd9d03a41
SHA256

393449e0bc51cf913ec7c0ceb5af646c855ba7959b71c6321f448d98cf0b7f4b
SHA512

1096ca2d8d75f804538007ce02e239d71b90cae5e9cd0bbf241224a146aa4f3a444024a0557cf2b3bbedc424402bcfc89cec1c5908ee33822174e50f2ac16805

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
2220	msedge.exe
2220	msedge.exe
936	identity_helper.exe
936	identity_helper.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1864	2220	msedge.exe	86
PID 2220 wrote to memory of 1864	2220	msedge.exe	86
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 1552	2220	msedge.exe	87
PID 2220 wrote to memory of 4924	2220	msedge.exe	88
PID 2220 wrote to memory of 4924	2220	msedge.exe	88
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89
PID 2220 wrote to memory of 4284	2220	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Abyssmedia.i-Sound.MP3.WMA.Recorder.Pro\下载说明.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb324046f8,0x7ffb32404708,0x7ffb32404718
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,7564361686377341937,7627823616151542922,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3557eea726756578c85746ba62b9a690

SHA1
3c2bc25a36cc44297ddd137cc9b5d9492088e6e4

SHA256
4a7b23c9e21b59bfbb6b1dc994f53326f44f22590352004124c110c67a32ee0e

SHA512
abcff60e571ef9b5b5c81f8d92aec6d0b9fbd5e8cb46c19b2fa51dddc82b70da524a2dcebffbc9babf28efb3cb4c05af09c657b821ffb84e47b4129f1b8d410f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca604c49890c6c15663763ba54a0dca5

SHA1
04d93948d73138ce201ec6b4c10d69dc038fbabf

SHA256
a85d42759820203757dfc7b764fe1484aacc1d2fca2c8abbf9a7767c170e5b06

SHA512
90dd5d16fdc148f66dc15977381cd7fd435c3f92858e5303e752eedd4c222dfb5e4ae4e74bd6a74b8ecd51d1c79eb10265e942c637d2a854997f8fbbaaf2771e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dbaa47af-e257-4f51-aa1d-8bfbbe3f0cf8.tmp

Filesize
5KB

MD5
abda371f0769e64f85c8b8cd8011de3a

SHA1
1525b1c12cc90a9e22102d1c7a3b4496fba04861

SHA256
08b44a776dc8bcd6918c037a32c2ec80bebb7c0b4443978bdb48953a376abe71

SHA512
98872143e81d83d68f20a0fd4913d3d852cb29d346f59dec7957ffbf652ba8925d4c6ef2dfdf66fa4b735543a1790dc6c57a10eeefbab969164e3e8a0b16ac8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
13b2cd967aef09cc22b8bd3c6a605dd4

SHA1
8f9f605f29774bb3f7afd59c0341768d697f5bdf

SHA256
bc07449a92d737c234477c6f0f1c18b857078de277825ba43f5f4a42c228897f

SHA512
5e785c200c02bef311d55489a7397542eeeb49067768938bf4a18bb6c5ae9fb32034cf2804c8922420ad1ec8f73dbc5082ad1baa7ed751689ce5f36b476446b8

Download Submit