hxxp://Gigabite[.]com

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://Gigabite.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
1812	msedge.exe
1812	msedge.exe
4668	identity_helper.exe
4668	identity_helper.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3612	1812	msedge.exe	82
PID 1812 wrote to memory of 3612	1812	msedge.exe	82
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 1172	1812	msedge.exe	83
PID 1812 wrote to memory of 4356	1812	msedge.exe	84
PID 1812 wrote to memory of 4356	1812	msedge.exe	84
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85
PID 1812 wrote to memory of 5116	1812	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Gigabite.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb611046f8,0x7ffb61104708,0x7ffb61104718
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4847519976484127628,14267146366375225767,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f6984e6-33c7-49ff-b0ba-09e7615a0a95.tmp

Filesize
6KB

MD5
aae47f0a9c9a3b6ededa1ee6d7b39920

SHA1
b72ca49e7ce785e0900aeb8a641c3aaf19825a01

SHA256
dc8209fd0142535110d05a0707915d82e4dec384fab62d8e875f539a535ed2f2

SHA512
04c6d2014cd55912aab87343b5c5b0254633e874a94bbd6015266da44717ec120c415a5566c5b6e7ea28306ae22a92ef730584146b6a9adce4ad8a0490050771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
512KB

MD5
ddcffefac58f205ea194e1612e7c22a7

SHA1
4db6276eccafc0030490f970824b55dc327bfebd

SHA256
5f12968474e2995c485a2c256a9819dde04e78b6a13aacadfba935ed7970234a

SHA512
4b8561f2bbc596382e9c22515354b94df9613844a2c6b6736dd7c1f6c51305e235c58160d8e5b3d6f5fa289dc55f6fd675332e4a13d07fd35282d61e227adc13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
be786941f717133ef7c7d171c0cd8ef1

SHA1
048b6197663e73713e29dcec271096113f9541f8

SHA256
6ec0d03d34177419a1b1065e85aa8f427afaeb657dd487b6547b5046a91fde71

SHA512
3f4c07416c3b0c29998e4aa05cc8c3d06850d9282cac2afd006288919e80c724c7a9fbacf814134c8283341b0a30ce60a4a141fc5517d25f337cc95f53d9fa1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
09842319cefef20c10a45cb1facda8f0

SHA1
a7a0a367d8ee5a4186f6e230d0ee01a0e91c9d15

SHA256
bf7964b702c318285db9107427a65213eb25abd70d3f400efaaa4f89c63423cc

SHA512
2b133a02e45af909fb7af1744d7574d0c43368f24b3fb60c5e9380cb933630a407eaea4c8a730931694056de675bc9731a7c75518fd5a47d5740515f2470b5c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a95fdbc3fe44c7464f675dc4f905c1d1

SHA1
f259ddf9a884004436addacae6956d9650b56fe6

SHA256
00a5470b2720790df6d257366afdd9c3ecf2ee24b1482baf87728f29f6b0ccf0

SHA512
6c0766fcc253b2a338e93d54c14e9bd182118901d299a54f7bf7251d7ab21c292ab5daa44e55ede621c8027487fbb7eb3af2840c895d8020376ddddc7d26566a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57efaf.TMP

Filesize
1KB

MD5
b8f1e2b34fe5b3a475668c68d3540dc9

SHA1
b31fbee6c25a5d191feacd695d5d3fcd31fa2730

SHA256
d9a74dff1e4af560931adae295c38e798e4e1ef5c78c91079e2bc821f9abfbea

SHA512
6e2fa27565dd6994e85927dd09a011ae34dee6200f4ecddd825db6d1dddf42d2e013692ee0401b4a71629176254496d09cc8aef62757014362bd27bea5cf9d8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da3d4a10-51d9-4c74-85ce-b5b60def7009.tmp

Filesize
1KB

MD5
7fbfa1a870fbda8b2d3dab72285bf99b

SHA1
b0cb215d2a70baba09085e9a6ee9c8c54592236b

SHA256
ed61df96228d158cec4a0dcf6acc746d9fd7f4ab382faab2383026d9e1982076

SHA512
e3487af69928ff92eaaccfccd3e15c8dbc9a5b5202265f55728e5d714b1732faadb9993e58172d627e484ac919d848ef6df2bd76d48099c81a06aae1520262f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0929d34364a8ee7f4f194f2446fe6b37

SHA1
2b6c291d4e8f2a4d9f01e2a1abef3cad08d205e5

SHA256
262dbfb5c3cf73853ac666e16909dbd74312350b1afb27bd3b9593ec22f697e5

SHA512
8fbe5cabfd313ea82c295c68aed649d40777a6ccb2ea1787a82a05891c6d912512715f5152bebcf266e6834b0afc67a0f5a1b78418b4eb224a364a7f540368b2

Download Submit