a222bdf089f24ea1da86f7a6a6335acff90fc329ee9e0f7a21003fa42624869e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ذ˵.htm
Size

3KB
MD5

3a7e9e5ad3c30b81eafe94c577728cd2
SHA1

1003c4d73fd36da952aa21c78d156c46cc236846
SHA256

a8e5c8ca6d0f3136561d7eed75bea2117f5fa9ea4611e37d544ef97b5dd031cc
SHA512

30734810ce2d71183c05d80ad751d786c0800799fdbb273e563585611d4178a31bc90674b31ec27771c0795705c8992c79f2ac5dde416df2825338794a6a3971

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
2172	msedge.exe
2172	msedge.exe
3876	identity_helper.exe
3876	identity_helper.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe
3400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3248	2172	msedge.exe	84
PID 2172 wrote to memory of 3248	2172	msedge.exe	84
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 3200	2172	msedge.exe	86
PID 2172 wrote to memory of 1264	2172	msedge.exe	87
PID 2172 wrote to memory of 1264	2172	msedge.exe	87
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88
PID 2172 wrote to memory of 5028	2172	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ذ˵.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa822346f8,0x7ffa82234708,0x7ffa82234718
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1575303712242262979,11656014744221350833,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5532 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef02108785976ef7cfdcf5fd5aa9dc1f

SHA1
685b1844e1cd35f4dbe4210ef8dcc95257f7f02e

SHA256
89cf519b348400eeb73bb68a01605e93a5b01096a6fb2fc4e1b3761e6748d563

SHA512
d5e8896df5d1a3915114841bb674a6acfd0d2ae16c84afc67bb404f07be76fd0cf78f7a50309ba9b84fd29c707b8fe04dd316a207d8f776103af243174dab7a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a775a8620f541358715cd70f8dc0dbf8

SHA1
3f8a157d11d99bbc3b19bef27b9cf2e06435d6c2

SHA256
bd224ad9d2531b21aa46d29849d81cafea21c7fa015e6a5b175bc240d83fcd2b

SHA512
577b39e5f490040187649a126c5bed3a34d8065f2ac36054264508b7a8b8174b37cf5369a9415a2106a769eb224674e924a042a9232fba75f27b4734e7a851a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e766499965e9bfa7e7eb3c1771eafc5f

SHA1
17f24204cc5b9aa7530c6f0e176ff454dc87c4b6

SHA256
69ba03f198396cdc4c46fb8beafc3dac7cb6a03190386ceb3401350bd3e8a35a

SHA512
5850026c4e36d94fb41e9c019ae4dff2ded76a8771ec4a6cb3e1597f3e45ade11dee9d1e83a03fb666298003f68fa7df21fb896a77401a349b064573c4180829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
73ba8351d6ee8daee40f22313b6a9b5f

SHA1
0f5e0f2998587c5db6c520957add08d9b6ee1514

SHA256
1d52b2268819ef7079482f269acccdd4839246f1114ad69a75b263b958ba2689

SHA512
ef8a147190dff1739abd9b3d251dfea3bed5923a67079d758aaad49e62e8956f7a05930131a67a65e6c120e7962c6ddb6938d8ccc2cb1284c8c5eb68079f775f

Download Submit