hxxps://rule34video[.]com/categories/roblox/

max time kernel
81s
max time network
81s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08/08/2024, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rule34video.com/categories/roblox/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6032	msedge.exe
6032	msedge.exe
888	msedge.exe
888	msedge.exe
3140	msedge.exe
3140	msedge.exe
3968	identity_helper.exe
3968	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4680	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4680	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 3780	888	msedge.exe	80
PID 888 wrote to memory of 3780	888	msedge.exe	80
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 1884	888	msedge.exe	81
PID 888 wrote to memory of 6032	888	msedge.exe	82
PID 888 wrote to memory of 6032	888	msedge.exe	82
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83
PID 888 wrote to memory of 3084	888	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://rule34video.com/categories/roblox/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffdf553cb8,0x7fffdf553cc8,0x7fffdf553cd8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,4351234769874222647,13992169948082760632,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1880 /prefetch:1
  2⤵
  PID:5984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5800

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000494 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e681bda746d695b173a54033103efa8

SHA1
ae07be487e65914bb068174b99660fb8deb11a1d

SHA256
fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

SHA512
0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f081a02d8bbd5d800828ed8c769f5d9

SHA1
978d807096b7e7a4962a001b7bba6b2e77ce419a

SHA256
a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

SHA512
7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
1024KB

MD5
652356113bf0373069b5148d79341714

SHA1
231c450f5b868173be6e5905b0c64f03f29d7a0b

SHA256
6eaa46789fbd899a7231980c143aa6b8e4cb12d1c815dd78ab6dd5e0d066e1f1

SHA512
abb5b60cbc6c593b692da4a42e83d0b744d6834b1bb1e1aae82402d35b3aaf98b2b23f856aab412e2d8822a3617770491649bf37752fab3f1298e3a1e118daec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
fa4e8b083149247b416a123138d3dd4f

SHA1
003076b2b497168bd4462dbe2d86881b3f02e4af

SHA256
f3c3dcef0913d70d1105768de8104896a5acc4c4d49ac7260d3a8c654f8153ee

SHA512
9ce1c848a6bab21a3ba54af96a920c65555eb7011cb003fa85f6f6c0ac5acd3cfec7b14bda79d7fdd9c6b38bc585f518e3d46cfc57bb9a4ab93950b3a7cf2bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f29cacde1e756e3c17afa008624a125d

SHA1
be1e2ac3f5898f327c0e513ece12512272e568b9

SHA256
1d27e6b105b0209e77be6280917d244f3e499b75b8efa5851bb90b89f17f3812

SHA512
bb79833811f257bef2998b81d85b5204663813b2294cd84beec7ab5aceedd4e21893ceb327206dd451a07f9ab6cc49530617e7ed4a972e0becf3ae99a7eb3691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
25e12fd54a6f65c5244d85adfac8f71c

SHA1
533bbb15a01131ca04ce4dcddcd333509b08d02a

SHA256
eee1d9c5205167f3c1848892ce1f91f3057ca003289936ced394172d41437f7d

SHA512
f78887a74c1cd17f408c80370c910431e5532d84452945547cfe681cc638ece274991f76bc7486b450c52c9e472b917b217dd893c93e09738dcc8e74d3571f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6dc50460c63237cdacd4117bb441afef

SHA1
5bf824d5ea4b5b89f322d0dbd006d91b92c59f46

SHA256
40797ccaa8cd3f1dcc82fe3f1155a81cbf708ff7959441dede0532e274b66dd9

SHA512
fd1c7d46941b95879b6ad689efe8a83d0467526c6ef7ba47e7900ecf731f7b3e5a29a082ac4f651c48c20a2c21d7f35fabe3e1e21348b40e21533445c67329a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
8ce378c5bed0f801b772aeb1cf499c18

SHA1
e29d8431f2e303a596d0240938c388fd68fd84c6

SHA256
4be3ac9d4de6d7856eb7ec6c2c9e7edd4282fc651deccd881642d036ac018a44

SHA512
1d81c01c44b6b4e3977c69fba90f1ef7f9ec6ff3833483c2ccae7402e976807831dea795483f6625f03d647f45bf0ed187a38501616bff41d54a0e7f90155347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581279.TMP

Filesize
371B

MD5
43c741b98dd03533c300149e08126388

SHA1
592110a5da04ad8c264829273adfea1188df1f2b

SHA256
396c38ebae8a3c6458c6e9dece68476f2d3dbbccd4ff202d131f22a74c9868b1

SHA512
74d62443eccc3c2903607b3d2d67910650110595bea59822fd2a216104833f7f5eb96ea936bb597b06f6cf0e17810a7671b393f86a319bbe005793ec479e4b01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e6e1f067d2e06b06eb97d84f3b09e6a5

SHA1
94bc8a8c9dda2111f9db2f1609dc3358850abbf5

SHA256
65422508f7a0e8b7a67dd8b81a6467af8bef86670eb10c73b032671f4612b852

SHA512
cc2199148bc16051a7254f8b61f9d74427cbd493e45e03b9464047d7e1625a63ad04be8acee01d64d7093cb38cd1b733483c516b69dafb9ca6a384161f2e9b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6890c7d4e227c869cb71993bdc482666

SHA1
05fd477dd126de50f889ad172ad4b4e69ab3e264

SHA256
8b55af09de7ffa3c82d563f7b40a53e4729130a157ca412489c3026750bb331a

SHA512
73d600ba690bc2e2f00812e129bffef26abc6a91c95b2aecf90aa3f765fd8e69d5c116fc3d05215924265e31451fad0bfbde4bc836bbd846fa6eab60886083f2

Download Submit