hxxps://t[.]yesware[.]com/tt/294aafa125b468c4d8d8d3fd793d4548395e3f50/3563c53094ce8cc935b5b5eb9321ded3/5a817753b06634b6ec0358bc16e961da/www[.]reto[.]com[.]mx/oferta-tecnologica

Analysis

max time kernel
77s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.yesware.com/tt/294aafa125b468c4d8d8d3fd793d4548395e3f50/3563c53094ce8cc935b5b5eb9321ded3/5a817753b06634b6ec0358bc16e961da/www.reto.com.mx/oferta-tecnologica

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
3800	msedge.exe
3800	msedge.exe
1292	identity_helper.exe
1292	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4368	3800	msedge.exe	78
PID 3800 wrote to memory of 4368	3800	msedge.exe	78
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 2688	3800	msedge.exe	83
PID 3800 wrote to memory of 1536	3800	msedge.exe	84
PID 3800 wrote to memory of 1536	3800	msedge.exe	84
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85
PID 3800 wrote to memory of 5072	3800	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.yesware.com/tt/294aafa125b468c4d8d8d3fd793d4548395e3f50/3563c53094ce8cc935b5b5eb9321ded3/5a817753b06634b6ec0358bc16e961da/www.reto.com.mx/oferta-tecnologica
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa062446f8,0x7ffa06244708,0x7ffa06244718
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15443732509752035270,3347016028877831562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
888B

MD5
de3dec21d36966eeef35a40a82037847

SHA1
01a5679bb30df6c2829afda7bc89f97be5e31124

SHA256
f01912dd29e3e67936ef3c741d0d85f490c0692068e2b4d8d95ac2842f49c085

SHA512
c03be77b0739c19fffe5599c3c1d7c5a0653eb897472f3f7f8d1ac54706ae6795ad37b6e0b7deb00504577ccac4ba6061929d15f02878d1caa5d713005a14ad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7090258020fe190c4b189a7653247153

SHA1
13e7d3e146e12c2933a87f4c7f94c8307968fb87

SHA256
4afa3de06eda98eacf2f293aeb13b90dfd0ca56acbfab396f16470c2135f6f52

SHA512
06a8352a6fe7457c341daaa3589b4b28b4fa9761047df1197e324dd5d9081e9d29f67b1b4d7fac4f18448633fcfe3ca26ce1194d811d91962b6fbdbef5bccff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
80a011fdac62d8ad148c1042572988fd

SHA1
21b10a894d16e5a0ba87e5812c67945138ab569e

SHA256
725e687684a64db7d756944d2e9b21c050f95653fcb8939b65e1988474aa62a0

SHA512
a3946ab1162a1697d98b77beb9e400f3a2099e769980b4c488dcde41d1d11f5977d2c3ba17169042d87f3c2a4cf82ea1ca62878905ba8088689036d65375aaf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea859cba1c01bfef74e82889af87d000

SHA1
4433fe45654c395dbf4a1e328e0fe00d82a50671

SHA256
2d1b38b87c10256122036ab328a2c77153e50a69584286448a0e0be1c43fd243

SHA512
d31a349e00500256584cd984b39eab95dce7c018e1ab83b0b42ba931e35fba090428f7ae73c8da6f22a4f334238b76d12d2958962fa42a1faa600326564d2d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa296e3129aa31cdb0f7d1bf55338c3d

SHA1
4d221d1b0d4962e3b5f51aec3d32b0f017745b65

SHA256
df32617ea2be8a7ed41329ddbd27875fcd73f0321d4b4b96747c2b2bf587a5c4

SHA512
53a12161c43ae5f07d8066300b8f29308aa8d6d6f794c3fb2a89f8722dbdfa9a513de6e0d2c37ec976a15762f04819890e5deffe5b287ab40bbb1e8ab8f828c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b1209d43089815d232835c1e935a5c88

SHA1
92f188c96cbf5a7fc40005dc3226587ee558b313

SHA256
701f45d0315fb95681ce9c7c4ade033dcae5df52bffb94c63535fc3a518aa402

SHA512
bfaddaafa33697e83614905f695c56ff3d9b402f932e531816ae7f61613102476567e50af73c5c7fd5731e807502b26183f0da161b8099c845a9fea1d259588e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583573.TMP

Filesize
1KB

MD5
d9bd19934eb2bb4fda5462fe703273c6

SHA1
d43c95b89029ee9330c35ac738539b57df765af9

SHA256
559b27f2d61c237630d4b38a3319fd89df72d2f398c6bd240f552c42d4822e4b

SHA512
5dd916868e1377aea6c3d85991fa52e630d41b729ee0e90538a7ac0530d777faec7242d466586d171643f8892c20c17461e84faf568a264cf63fe3f15456949e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fba716635ce4361f5ac7f431f07e0d39

SHA1
2c565c97a373b8de5167b5c9c678231b8c22589f

SHA256
f276233912af48a724163febcaadef5033cfab1ac2e5904ae9d640aaf5d9725e

SHA512
1d85c619ac92be58c3f2dd81746855051d70f15051c2e8f8f4922bd0f354bf308898774638590c7286758fe66e015cdbd82f082562a054fc4941783736e86079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b2d365e60f33759335fee6635e7c18b3

SHA1
42769e4a45fde175b124b490382e2e3763e8a5eb

SHA256
cd908e0ba48f285a931511e7592af51d345772f56ffa45649396282227be4673

SHA512
96bae1c9fe5eec69c41b567a13bbe1c702b4747fdc8edd528d296c1668d7cdd055abfe0aadb09948128d993f451897ac27347fb5189b26d8ff327d4d13a2aa8b

Download Submit