hxxps://emp[.]eduyield[.]com/el?aid=2newdda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google[.]com[.][//][//]amp/s/nuopportunities[.]com/kaku/dzj30/captcha/YWRyaWFuYS5ncmlnb3Jhc0BkZWx0YXRyZS5jb20=

Analysis

max time kernel
79s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://emp.eduyield.com/el?aid=2newdda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/nuopportunities.com/kaku/dzj30/captcha/YWRyaWFuYS5ncmlnb3Jhc0BkZWx0YXRyZS5jb20=

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
1612	msedge.exe
1612	msedge.exe
3240	identity_helper.exe
3240	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3644	1612	msedge.exe	90
PID 1612 wrote to memory of 3644	1612	msedge.exe	90
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4944	1612	msedge.exe	91
PID 1612 wrote to memory of 4900	1612	msedge.exe	92
PID 1612 wrote to memory of 4900	1612	msedge.exe	92
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93
PID 1612 wrote to memory of 4376	1612	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://emp.eduyield.com/el?aid=2newdda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/nuopportunities.com/kaku/dzj30/captcha/YWRyaWFuYS5ncmlnb3Jhc0BkZWx0YXRyZS5jb20=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb271d46f8,0x7ffb271d4708,0x7ffb271d4718
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5495266364044731578,12593723059302860600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
  2⤵
  PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c5774b58875dcb49e7da7194b99bf32a

SHA1
813a24d75c9b250a265943f1fbc1079bfe1528fd

SHA256
94ca00bca86d13ac01458e0a67aa844e1f17d8e610eb7b46fab9d0c6dcc78676

SHA512
0656902dd79e5e928be367abd67d08172ee54f24038a7098599c20974fd64f0da9dd80ebd6178ce1d0a31faa3f941dacc89a69b11b2f7f166d5e90a5a2a8c42b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
9f788f71dcedcf5579061d780914eb55

SHA1
87895cda8497d181f5717104a956aadcda32b084

SHA256
8de6671dae1bb3eb886ce258de5515a88f0c9825f0886ccc4d27ffe8af83d994

SHA512
ba74b83580c6ad6e8b9ca9c9c74a87a5f66f02e2f837c912edfcff6feaf43caf8c3366dde0dbea25c4db329c5a8e6560930f44de123f2441d3a658aec2b9f339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
888B

MD5
0141768ba4906b0a9a9f4962eb175c5d

SHA1
fc51e2391fbf8c9549b01a05f2ddaad313db5d99

SHA256
ecfe09df0ffe89552b4b69101907a47750473af384de56e45a05d5791eda20d9

SHA512
95c8079c8166cd214bef5df6aff2a9da34e7a983fc78f1bdf6b37c72ea52077f8f756bb43e5d7dadec2a348011bb6a5828969b0006dcfeca3cb1a16ac5bff9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a836dea4b07d583c374a3ef48627af61

SHA1
146f477a66ef6f7577c624f922723a8bfecbeda9

SHA256
539a886365eba86ad4cceba9a725a7ab431027766f223f726b8f36c47e60e82c

SHA512
085037910e7ef95b481e973912755fc4f9e42f3c214c2897e0cfb11713e9948a8cfb50c1db10d89ca209582116d758144e644d1c7b8612711aaa2fbf87a1eb99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93b5b81d7ae1acc670c5870957bded02

SHA1
a4f8d99b4764fa65afedcb33ec16c8ffb275ed9a

SHA256
be27171ad95055df6187113b09a4c1a7d27033dd239622950f8cc4d4cb32f38a

SHA512
ae43411e47de2f2ad0b892a8c79f2da97af381ff49f4d70fce43bc4114c1b2afc255b21a42e984c88a569651dca8d9d9d9b477ba282ef8fc4ee6a367af0bf1bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
186f7b122d69521d06590d760f718fc4

SHA1
bb4f0e87b7c8a4e54401fe76051bf1018d729a1d

SHA256
02c6ac6501e3e68dbe0d53b466656d9c82d4e3c91b563ce583d31488d28acaee

SHA512
59c1a5ed17b587bb2b70640b03e174b57ebfd14ff35b34b8b2c69828b90eed960dfa8e22af783b002ac6154dd3012a8936bb2d6e19a7e92654ba2cdb95ed3666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
50ba3942811ab3c916b0fd85fc834827

SHA1
320c646fa5e8e05060339ea64a77251df338cf17

SHA256
a850444f09319913a056836b457a46845c5fe4f4b12ab629150020eb2a8bfc60

SHA512
9057b456580c5f32b5adc36f43f07e3e78d79127a9671f92523e4485ea04aec2df3feb4f932def930efe17f9d28c47335a1f0451d4c732a2ffce268bd72757c0

Download Submit