hxxps://nezur[.]io/

Analysis

max time kernel
99s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nezur.io/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 1796	4784	msedge.exe	83
PID 4784 wrote to memory of 1796	4784	msedge.exe	83
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4740	4784	msedge.exe	84
PID 4784 wrote to memory of 4812	4784	msedge.exe	85
PID 4784 wrote to memory of 4812	4784	msedge.exe	85
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86
PID 4784 wrote to memory of 1292	4784	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nezur.io/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8b5d46f8,0x7ffa8b5d4708,0x7ffa8b5d4718
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2772 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,864522488195034034,12000208824908755449,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c 0x494
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
1024KB

MD5
ae78984688bad532c4b71ec4da822f3d

SHA1
64ee212978d5a0fd7578f380a50fb6f6ec0a0ca9

SHA256
17f2e5d353360de2bdb79616bd05d6cf9a96f09e949ec3c0de4abef71fbefc92

SHA512
6f1303cd2d05f551859cbd486c81377a47ca3d2da9ace7a85e76974599f8666507bee8a08764f493e416185d5e2c8477c0ec24969a4bb25146c7005422c35aaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f36f6ff2d467093f831ee4241c7cdfbc

SHA1
c18d3ffc19248dc048c8bdc960b6711406b51149

SHA256
b3b089ab6f7d2f1ec536f0e72efa038b7dbb30169992b5e507e89ab21108b7e9

SHA512
342f1f86950db9d2431d5a1ff5a10238dee5f35e8601b442b76945b292ee87f7f6e5122a153acc734c7264ac45cc8270b2f3c61796f89c9fcbcb37c0ac7d19cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
962B

MD5
abab4f2970b2fb56c73649a601951188

SHA1
332bfc512cd8eebd9b00156b70145fcf4e541bae

SHA256
7e92bc4ba296acd22ddfe81475ed3dbf6512ee17c54a5642bf5ddc983d87934a

SHA512
2054cbf1aa0b8d3bf3d2cddedc649bd352c53765717dd8b78a66061add7ff2131e4f58a1b9b91c5280416d85d2cf1811734466d4e8da260c7772a92fe03d926a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
78ef85bc0686dc4ee6313bd7b43e9c11

SHA1
0986f6b281a43d715a08c757b46333f0119f98ec

SHA256
5930ae6358d4329029ecf1c01ac4152c83289cc410a324c5967d8793bcbd8b2c

SHA512
dd103e629aaa3e1a7a38e2661161ef80006a3b80f040b0e27bf0cbb173c6c01e3fd042d6d37c0621038ebff4144939a9a86de2593eca6adf16a638f3ca2f8fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4fd820c4023e499b2124bae52741f4c8

SHA1
8e4fdd8a0acf3ccd7b47da49cbff61c4509fbd02

SHA256
fdf877d78f859cab7b427e4234d66edd9f81013520a409fe2d11c6cd66a999cf

SHA512
b8b39c668ca6a24890f0781e85db22cc54fbc02f910b2761dda1bdcdb1ee3fa1d1317410524ac2c36fac9016eba70552c579dab86488016940fc80c1144fa312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
659b3741e8ef8eb48053554bfc294fc6

SHA1
38da176330a3ef768b39651e8027a36ea641998c

SHA256
b0f75b30cadf61f313ab8632b160bfe5989791dc699bc16c99a97cb8535d9c94

SHA512
557ed5edec334f461807ed68aa04876b3d4a9f0f86c7677ae8d6f628b39abdb0d9ffe2d417bb141404961109bb9fe0315f6cd68682bb8452dd8356387ca9166d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19fb54a4b7f3f622e5e2a05abfc1f69d

SHA1
59848d4c9c4160522de9c9e4c2e789925061c2b4

SHA256
97c123ec35a0469c574a5c3d6bc5d9614972b7368d0e7ee63a8d8cafe0163ab8

SHA512
d7c33baf71c555ca12594ca5060c1c48c851a4f0074388b2aff68288534b5e5411da633b5399b554718222299a70d91bf3f228abc909b794318f4c4f07b85e0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
2e9303398e292488008e2b4e1d69e5a4

SHA1
6ad792a23c7d59e229245f4304ade079d74722fc

SHA256
e6bc88eeefa056eb2de66d946d04f387eb6482e121c482965d1cb927ddad5677

SHA512
125da97d9aa1ec4be005c7aa2ffddbd5d01ee7eb733d785ff80807be653c972239a4587214e01ede8944a112f82d081d6225f33f900ed2514821a8c806620482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
f3d953326d2c3e043b04af9021c4dbe1

SHA1
538640ddce78818a437d993dc02e5337d71aff13

SHA256
c87faf0f25e5931eeb4306d648308e7757d0cda6677625f90d1e720953427f6c

SHA512
17e92b2213e23b8f42bfd287e73c83d0f135da2ced79c0979559fe8a9222bcb63b6166f8dcaeec5d489cbe4a24f55ada7688db277fe8eb291ab2807417707969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582fa6.TMP

Filesize
537B

MD5
13c5f00e2684547155d8b45d45d52a28

SHA1
9c698271ad0ec7cbf76d16972b18e7e81b393dfa

SHA256
46cbc3034982ac8b3f64fc896f9679e156a433be357b1992ce34ae81d09c78a0

SHA512
59995046981c0b3f2c8865411fbf5c72e9281589edbbb3b2adcb2a00694ebea1fc8949ee2b5f42054ffb2a02378aa4c83b300aeab1bb20f5276a0646b65bfb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0bff0d62dc2d2d82bfcc119dba483570

SHA1
87a1bbeaf0020063b66f6c1453bc33c62143286e

SHA256
a398c8aaf5339ae45faa2e275ac82959c03f047e34c9a7fa1bd4359e59099758

SHA512
9b6c01ebbce28d56f06df8411532cac9a6d9b291918d2c6ad4abc49293899a061a2e13071b3f51620783a46d9d4f98f9304aed0c9e2b788ed286365d8461b638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b99be52be8db878a2f251d109090170c

SHA1
1ee7dba7ba2d1ac6da7e12336fbf63ecd1775b01

SHA256
63e326c40d17f394f647538915578b7de3f50400e84c4d6aee198678d6f6e03a

SHA512
820ff4502a9b64ce62c0c8353f2659446655b0121d30fc1f2c5000b8062607f2cf125ffbc304970a7b60241ddf759cbd1658854abba9a7ab217dc9c4ed5be0c7

Download Submit