16bb67a19701b6501af30450601c2c29e1264e47157dcec20754f27d1dc4cd03

Analysis

max time kernel
1164s
max time network
1169s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
16-07-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pikmin.txt
Size

508B
MD5

15cfefa805d48ab3ae4030dfd6f3ab3b
SHA1

77af69b52616f2a487f2acdb0236e85f18b85ef1
SHA256

16bb67a19701b6501af30450601c2c29e1264e47157dcec20754f27d1dc4cd03
SHA512

45880fffe5dec2b553d8b27dad929290553613cd7228f55d396fa1514e2f93e0eb2e963df1651fcc1d6d1b8e3885908f86da674ff1ae90ff5380d8a7e19194df

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2016	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
4800	msedge.exe
4800	msedge.exe
1200	identity_helper.exe
1200	identity_helper.exe
3656	msedge.exe
3656	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5064	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2016	1568	cmd.exe	83
PID 1568 wrote to memory of 2016	1568	cmd.exe	83
PID 4800 wrote to memory of 1752	4800	msedge.exe	90
PID 4800 wrote to memory of 1752	4800	msedge.exe	90
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 1888	4800	msedge.exe	91
PID 4800 wrote to memory of 3032	4800	msedge.exe	92
PID 4800 wrote to memory of 3032	4800	msedge.exe	92
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93
PID 4800 wrote to memory of 2500	4800	msedge.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\pikmin.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\pikmin.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2016

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffca7ae3cb8,0x7ffca7ae3cc8,0x7ffca7ae3cd8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,967572042147075268,7714139959516047043,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
575466f58c7d9d3224035d23f102d140

SHA1
2fce4082fa83534b3ddc91e42fb242baee4afa1c

SHA256
9da0e657652daa1ef86af7c3db62b0af9cce372a5f765c98c68479922ccf1923

SHA512
06503e718fe967076dd8a061b57debdc663b9616b005f8567099a84fc7184880633079335d622c243918efc3356b40e683708fb0583084abeed7db6168a212ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d33f465a73554cd1c183cbcd0a28a2

SHA1
f5c16fc4edff600cb307f762d950500aa29a1e8b

SHA256
22d8c228cdcfd3e05431d7377748014035a3488ad3a0d4aecc334e724245a1f9

SHA512
7cc94f77f3943143ee86eabbfddcb110ce52c6ff0975842e3a3d06072f51f2c48914ee61f24484a539888ad19a7e6a1becfb029485cd5984bc736434a63cee95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d640183e6815f78101b556d70089e05

SHA1
02e79c2adadeeb4ce3a128052516f7437eb859ff

SHA256
6e3eea25ac5a569504cd6d158e2259351ea799bd660ce400405c8d321fe237d6

SHA512
c010a965fb4e44540e0fadefa5dfcd17f3039510ea6a73fbcddce20fb49afcd84f4abb9112641ec3c25b52d2a0b0a1e12dde0429f626109c92c63350f445dc92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b4212fe73f7e2a5404c3fcc4f804465

SHA1
bbc5e1f9474dfa3f20234aee003bfba310066081

SHA256
2a8fe2ddb005d7284f25056cf3817782a207882b4f9b41dcad0cf7ab880c349c

SHA512
40663a898048458f5ec24321e474a7f1db0dc0ce80358a32aa2caec11144ec79087dd0b4c2846bb1ecabda323029d2cce2d28f8cb37df4e888470b97f9ef6d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b6dcc0b987c31730e8ee7b5f749d17c

SHA1
6938ea902473ce88a54fc1a0eba0e02a8a65d028

SHA256
aa3b79b7593dc6fac8a515936e00e0ee837cf0c876aa277f7ba562685cbc4777

SHA512
b613d964a0d03e7ed0a613fc66aede09cf978de02d2637e2d5a9ec775430769d7a0a9617f4c278e453df361f98dcf295f7d0420141800ccc524a98f79a9f2f2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1e840d27fbc5ee5cede335e89f9e4a28

SHA1
3779cad0eaf04780bfb0bfe81a57fdeaabad4a77

SHA256
ba1d0ea6564d3993faf844db70ed3bf50864a961261bf6d1c926f25c4840de56

SHA512
bd2c4bce3a8b4b97e0034e0956b992af35f790e2f6ece039b5ec02e3eff54af68a0f2f971339c1fdf029a47c65859d7515fb4264b567a78090fba03310c1c1b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a78e53deaa3b00936b3e7b4c77d7739

SHA1
93ee9f1fb5376bd116895ac28ecf0e682a6f921a

SHA256
af70eeebd7e7885fd48af2970dd15fa3ffcc4a631d3907caa6ba39755b15c0bf

SHA512
76fa8aff877523ddaff270f5321743667eb57c0c9f6a222e1d5bdf825da4fdaa93aea767f46b41ff68b9d93b925252c361d0eda5ab26bc93fae010c7a46dbb09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6083c8359f758576a390e5c11268f3e6

SHA1
d2a0c526946914e1107b24bcc6ac26907c1385fb

SHA256
94e26bf06108343f46062ac032b66cf8895b008c2041eee8f54978b0baf0707f

SHA512
d92288adf621ca7d57d94001e580d517ec2e4198401b55d5f691ade01aff75316dfe5a7c010e61de8d39d73a232d65c454377f44c54ca7ef26633cbfa35dd6ae

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
11KB

MD5
f14d35e09a6dc5894408e3e4d2b71cdc

SHA1
df29ec121d401c6894fa1abd4ccc73b164b2beff

SHA256
8880a0b04af6e95fed9d68f98585fa976416a373ced4706c535bb37a8820d984

SHA512
e5ec58fc970dafb685f6990b213447e9fb4e40a14c25a79567f619d68be5b05061ef736110026d389c343573e30fe134d0de442b53593af54dd29b3c446d306c

Download Submit