hxxps://myaccess[.]microsoft[.]com/theermgroup[.]onmicrosoft[.]com#/access-reviews/bad86496-fe17-40b0-81a5-cbd2f9d5a8b5

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://myaccess.microsoft.com/theermgroup.onmicrosoft.com#/access-reviews/bad86496-fe17-40b0-81a5-cbd2f9d5a8b5

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
1480	msedge.exe
1480	msedge.exe
4668	identity_helper.exe
4668	identity_helper.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3220	1480	msedge.exe	84
PID 1480 wrote to memory of 3220	1480	msedge.exe	84
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 2024	1480	msedge.exe	85
PID 1480 wrote to memory of 3840	1480	msedge.exe	86
PID 1480 wrote to memory of 3840	1480	msedge.exe	86
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87
PID 1480 wrote to memory of 3716	1480	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://myaccess.microsoft.com/theermgroup.onmicrosoft.com#/access-reviews/bad86496-fe17-40b0-81a5-cbd2f9d5a8b5
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92db846f8,0x7ff92db84708,0x7ff92db84718
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,7720171385468123074,1916794900075473606,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
48f1a78b2f1c85dc9d6fe667353053d4

SHA1
346da5d28561aa2c68daf95ca308d5d1a562b462

SHA256
a0d1be6de1676256183527b9407591dd11488c58257af5313a212a14dab029ae

SHA512
f900788134a9e77493e1533c0d7c698e58c4e408f81b8e863c5140431d794db74e6b535ba00f61b41507078dcc94ca01035d36ec25006663cf6026f2eca64314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
531B

MD5
bd9416721e0250d32e251a1c86ba35d4

SHA1
9626cdbcec6cc808fad559fd4c0e31b0a738e624

SHA256
c6a586ff73f2537ea6939b9c3c584f66fcce2185e0f32488f780125e4a818591

SHA512
bd3a090d341cf9a914f44f4017386c58c9e59dcb94cea7eb49c5bb0bc8e69e6b8b608012acb092edbbdd9a9f2dcc910b5e6e082ec26f3f3dace17e17d1ef3c4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ddd04a2ada37aadf508a1d0ffa421b32

SHA1
d9456e5c92c7c310e0af050bf30279cdd144f5dc

SHA256
5c847af4b07b09bdee224e4edf9c9861d5e7cad682ed1178b09c6443db3b0849

SHA512
683f323825c780cb31cddb0aaf75a3ffa49be23512270d1e6b70790beea4280819c69e601f3a05486b33369996f21d555fec84a325a2f79dcecf3768c4502ad7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa7646ad985ea068ad766956e8972b7b

SHA1
41df8bc2dd792b74b62860db890d144198155f17

SHA256
2037f74186110e659f5037861417bfa791ba0bfb6ef467f1aaef82cb579d081b

SHA512
706131727a1a49826a43ee7128c80d3ae8da77d9532d61142859a15f8a39f8ebac0306029f5d1cbc69cafc38043c4730b85c0a2db0b3641381c3cfdc0fbc1a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
cd195665a83befeabb4cd87455376a10

SHA1
890d2fb554f9da89328816cbbe9ce6ffc50b516d

SHA256
c9ead83571464e1b38e58abb8c0ab605ce02c20445b7786736b2a5c4710fab76

SHA512
f7dba29d45bce954fca175497ba923bf81ed82fad0de9629a96c4a1dfb7696adec4b490c75c431634af9d4a47ca97b40bc12c52530d4bbc9f1d466fa30f62909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
b8076965e88a71206760ffb53bbb544b

SHA1
315ec9652bccab1792c8781ecdd08da3dd9c1cd9

SHA256
938ad67a3355c4f415206cbf1e890a381d2e37e22a476422e6c23ab2233cb434

SHA512
f3411ed8a76c20c4e89ae72b44d4d2fe9374bc05e95a2281815d891a18c52db83945553c410cad8ddc8f8145773df012f4b14a95784d202de025c23915d813b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580a2c.TMP

Filesize
874B

MD5
62e0e1de71e8b63b781e071f6fb7b9de

SHA1
3abcb12b4cfdc75792e0fed7857847a0282df46e

SHA256
bc6dd1ee66867a09d9972034a16004fc237e5c7aadd98226a68b38f26bca6274

SHA512
c01575a3753f412c0d5c69ee7f2e851a9b7ae8269e151cf9afc692df1620507715e229107b7cd77e3e7b1ebce5776885a1b8cc97ecedd003ddfc32f82b2a44a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca29373149aa42fbfcf8dc7d687b6d35

SHA1
f000bc058651f6fdf83092aed3a52f5758aa1d59

SHA256
06a77708e59cc586b441e70f5bdcd20d9b4be85b45829f1470dc6fd96bc65f16

SHA512
ccab16c9215717f652afb0635fcbf23c3803fac7ada3f1c3b04bc34877a9eeb19b887738f85c2ad3fda5b5089848dbe6ae737d69d95bc38a416da8cf98d2a678

Download Submit