hxxps://winanimperialpower[.]top/?u=u6x8kwd&o=6c8kh40&t=Win_US&cid=472847A0-6E45-11EF-8456-5196A25BC8A5

Analysis

max time kernel
62s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://winanimperialpower.top/?u=u6x8kwd&o=6c8kh40&t=Win_US&cid=472847A0-6E45-11EF-8456-5196A25BC8A5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
4328	msedge.exe
4328	msedge.exe
3448	identity_helper.exe
3448	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 2456	4328	msedge.exe	83
PID 4328 wrote to memory of 2456	4328	msedge.exe	83
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 4072	4328	msedge.exe	84
PID 4328 wrote to memory of 3544	4328	msedge.exe	85
PID 4328 wrote to memory of 3544	4328	msedge.exe	85
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86
PID 4328 wrote to memory of 3932	4328	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://winanimperialpower.top/?u=u6x8kwd&o=6c8kh40&t=Win_US&cid=472847A0-6E45-11EF-8456-5196A25BC8A5
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84c9246f8,0x7ff84c924708,0x7ff84c924718
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,15613909372951980993,11355490952284965964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x4e4
1⤵
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
999c3689192bf442fc04d167d39125c2

SHA1
3d02774fa35f537ac40aa37dab995dd5cf869cd6

SHA256
860cba792c407290ef5428d603166c4611b6341a394360b7e6d84b4196275c39

SHA512
d5aceb6112614dea7145e9293830c747ed788600118cb59d40e7074581e5e4031a78f7dbfb2e10b0c8b78f009c664620d1c9cea148e14881d49b2353dc93b357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe8d1fe7911b6f72437cbdcc3ed1f657

SHA1
03506f457606415eda083913873409ffe476dc7a

SHA256
215c71ef11809012d6ec7fad70a971fb212bdf78bca35c0b8025b4b298cdee3e

SHA512
01c028ed7fb430b26172d0289410651f99ee4427e6cd68e5346abbe4af37992f62bee4840ef686216bb0e49e8df9bd40e5f9806c17fd9989bd55bf3b2f98266a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2f1471cec57ed58a86e6759c2ca97a6b

SHA1
ee9f0d818e1bee9f5a5012afee4f1b14a16779cf

SHA256
51f24feede66f212f65a502ef00509b3c5b0620a0b0f89814ef3d27bfd3ad3f3

SHA512
aee5575408e59b5f6632c9909091b3341e86a9c1e6b4108d3efeb837cf3e477b700fe1d1242c0a3db02641fdd987c72411c1f36546f9a814e336c78eb26b8985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f1f3259e1d89278f86d14124b9777da

SHA1
87680d4c7e21a5abfdf14c20b6c45ab5fbf4c62d

SHA256
798420668b7bd5df2f5802a2ec28cd1c204a2c7c9b270b043aeb63a1f21c2b08

SHA512
4f55e00f5fea4dc174f2fef840e9c8f57d9a1ef12b13e6831e9cc878fde93da43a3d4486421c3dd080800a4338abf6bc41a8f1255879547f116834b9a22572b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
1c0f11e6df285384de67fcfcac9d8592

SHA1
45bc6cb246f1f8aa27a744e971662f0e779e9a85

SHA256
5be886ddb2e90fca0f6d3a25b1bb6ab119d862836c376de4dc1f0a568347c66f

SHA512
3cadb931a72f775afd9d7205e1ca946d0270d942eea4b63b7126c3b5ae6d7c47e8c1826f3e5519d9a65ab311deba9def05de29b9c4fe501d4d48dbd2543821aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
7f0cf1c6bfd1e7c8ac36aa77817262ba

SHA1
92cb5030c7db7c6bc72e6da1537ec333e82a74dd

SHA256
90b61943fba839a562f24648443c75298bbcaa06afc313ace0888de3e3d7224b

SHA512
e25f88c68cfc9ed9a3ea51583ba82ee2c7a617c9634424285b1de7674e9085913a179776889cf1709f6381749b9ac00c1f45f01d9872b58a55c4afb080815dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5831b9.TMP

Filesize
203B

MD5
e91fac0046c8eaf324052b381fe0117d

SHA1
d15fef7842b8a209e525cd328c002203e6edcea6

SHA256
16fa7156ba3cac3265aa9998d30681c0a80941fdcc46e2fd1a73725fd8523ed1

SHA512
4e07fa2a5a1329989f1bf3d1e4ea51a8937530b25e30f64570df435ccf8241ca7f098cc3e0a147d845cff37a5fece3a85b0b02f89df82276b18303f0474fa3ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f47e2ff2a0521a75c9e0edfe1bce8ae9

SHA1
287ab2679a4637193e0c076538025230fdbb1bdb

SHA256
27c35b876fb4e72775b57beb67b58339665b4f68cbe2651312f5c06d313c3b66

SHA512
e0fbe92600507a2e9b562434becd66d173044f24f241bc7381a7d50804aba6d85f3b634411f8212ff8ce6cbb113e32c97c02500b6a98070f05b83bfb64d3fb52

Download Submit