hxxps://discord[.]new/eCcsw3dEcmNy

Analysis

max time kernel
268s
max time network
277s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discord.new/eCcsw3dEcmNy

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	discord.com
13	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4204450073-1267028356-951339405-1000\{876B4F94-028C-40C1-AA87-8DDD08A8DE15}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
2000	msedge.exe
2000	msedge.exe
4624	msedge.exe
4624	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1508	2000	msedge.exe	81
PID 2000 wrote to memory of 1508	2000	msedge.exe	81
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 2832	2000	msedge.exe	82
PID 2000 wrote to memory of 3340	2000	msedge.exe	83
PID 2000 wrote to memory of 3340	2000	msedge.exe	83
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84
PID 2000 wrote to memory of 1052	2000	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.new/eCcsw3dEcmNy
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb927846f8,0x7ffb92784708,0x7ffb92784718
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1484,4188355019828985225,16981648206450227234,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
156KB

MD5
3b0d96ed8113994f3d139088726cfecd

SHA1
1311abcea5f1922c31ea021c4b681b94aee18b23

SHA256
313818d6b177a70fbe715a5142d6221ac1a1851eff5a9f6df505670ddcd73074

SHA512
3d78c250029069e1850b1e302a6d8a5154f6e7bc5cd58f449b8824ccf418e80dba2d5569a9cff72f51ccc9de140dc91148f93ec4717f4a880e2ba94898fbdb24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
97932497d6eaa9395c708cf72d6b5a2d

SHA1
48e070fa9dddd8ff5f234e9860f16a256f825436

SHA256
ef0c9cce6812b18951b006b6376cc8dc937f31a85d0e09b1bc9fa223107aca7b

SHA512
ec35a14c6866254b86c7e3f0b848a221054ae5e97e20eab64abade9e37f1d30c70260c3e4dc89c792aa959b60c6d2b576d1d3233ba5c7c1a81fa49dc08165aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
248B

MD5
bb0a4087d38d6ab3f880144be89b5f1f

SHA1
309c7278e6932a26dbc6b50fc2926957aef7e669

SHA256
8792af8750377505e0539c27d614bf062ddf5f98635d761f3967d4b73c07e3c9

SHA512
c03faa7494df87254098732586e583e6db288349d4f3cd8364931d28eef9dbc022a79930c151a05a1f6df9cb97eaa8dc931cb2dcef5e61857519840769b22ed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36e23a3bcff47ad6e403a25ce917441b

SHA1
697d2f654f81e13e5cfba2e56186475fb6d37ab1

SHA256
099e81e03a1a86f6ac5884a17b63397c9a5aae6bb6f985a5e8ea32ac32e2da82

SHA512
ea32cc6319a2293c32de08d42d4f702b03fd04d26017e1ca6d4ef15d170e0c6a7acabb21596e0a59e372f5c9d0e5924e788aec97e627e27f930d247aa0c2dcd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f07e28b42b541010d1582b244c5ebb17

SHA1
25a92e11d561ab6f9d42dbadb59e15ec60115fc6

SHA256
a5eb8f6097c04496f04f341bc528e60d11dfc095d0cd41cf20d9d73efb20d0de

SHA512
2eb75592ea057d4f11137b1647ced42eaab8049fc3a88b5a8fec9671f1dc843049f5d4a3bf884d905da614fbf954e04813903d7c385d39c7cca6251c49c7415c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5051c36966eff14600ffd5b3ebfb2d22

SHA1
a497b5b899e7590ac69cc02b76ca6c417225251e

SHA256
b7a214f8a313565ecff8d0fca9ce39881a80dd8e89deb35dfbb3c8802dfb8a3d

SHA512
53cd173a87b585281b8ffc0ccc7ab5dd13ba652eeeb8b21e7949dcec1c52faab05e8bdbc91e8c37c67fcf686e1ff3a7b250a3a5917cf534244d054f6f1c9585a

Download Submit