03902be743ffcb706c54dc5d972aa2178c4c762213afd69b79ecdf2fcc4e1518

Analysis

max time kernel
488s
max time network
605s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2024 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nezur.exe
Size

14.7MB
MD5

b69e41217fcc23bec762fd3aa79b95bb
SHA1

ee04c6bb804f89a547079ce5b4abba9ad4b5c179
SHA256

03902be743ffcb706c54dc5d972aa2178c4c762213afd69b79ecdf2fcc4e1518
SHA512

39c45ca81f284cc76d64dd66fb99bd9d0c713d446e741c5e8dcde94bfd1bf0a71f3e6031fdf877fd815f06a9f84032e79939bf50b5e9bf8f5ba0555763e3aa5b
SSDEEP

98304:UiHbalWeWP84rAJzM0gLIRfyC7egWJT56w65z/vA/OcOQi8ur+xMsnKMCFJlIsz9:TOM8Wb0guheg656w6Vr8ucnmtz9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
4880	msedge.exe
4880	msedge.exe
3148	identity_helper.exe
3148	identity_helper.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 4880	1424	Nezur.exe	92
PID 1424 wrote to memory of 4880	1424	Nezur.exe	92
PID 4880 wrote to memory of 4696	4880	msedge.exe	93
PID 4880 wrote to memory of 4696	4880	msedge.exe	93
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3096	4880	msedge.exe	95
PID 4880 wrote to memory of 3244	4880	msedge.exe	96
PID 4880 wrote to memory of 3244	4880	msedge.exe	96
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97
PID 4880 wrote to memory of 4264	4880	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\Nezur.exe
"C:\Users\Admin\AppData\Local\Temp\Nezur.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=7.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc867546f8,0x7ffc86754708,0x7ffc86754718
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,7514320848418638894,8941839344066474516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5432 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
4c68fa9da4031e4f6bce89afb698f67a

SHA1
05253b06c10ab70558beac773286ef6c56292e6c

SHA256
9556882e8bef920eb50efe55b57afacc70c710e8ab808eb95b04e8d4b88eed2e

SHA512
e750014f86f1ff47103a585b912659913f4b40c284444747c770d3ca870cbd2ca1f249406b815c518c59d5b6f95ff3761bd56912ec799a22170ca0f7aa9a7ce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0c9a047355832884d63dcdede50ede28

SHA1
904a603c5bd6ade1fa16fe58c9495678d5d78ce4

SHA256
abcba98a43bbbade69540e109bbec56738a3570a804e2713d388350e82bb716d

SHA512
3412a7530d3f8a14e9ad9d717ee69c84686e4e95894ac024ed0cf2e1b3c10fe7224db00559cf205dac43657f6888e10b5797e56a6080782fd2426264be977a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95e5c95d2cebadb421eff379f5dab83c

SHA1
e8456e4f01c577c757e3d9e40fe32387f543557f

SHA256
be9c0882e47ded61f8a4dabd865a3d8562884b407017c2a690beecfd5af4257f

SHA512
15c4b4eeeffd42a9005e02d16f2294980ab047ca643a7bf85e9aa57a3a1fd732896fdcbe2944cccf7340491bf8c879b49e7f0dc7583b2029a164171b5ef6e83e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d44610133ff0c762a13772c3e07141a3

SHA1
b49ecb4dc79f001f61bfd7dbaf28b5bf0e8e4530

SHA256
fb872b9472d51dd876e765d67712d94d4de782fbb2d807c85b1026b7c22243a1

SHA512
e7a5b2f26b7da3e34551e1ee9d54cdc265e2a6847f000e082389ff7f5b9267e8c74801aad73779634a7bba52841904a5ce995725880983d8484d7a69403432c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6efd3bec11f5c0b6d67238dda535ef11

SHA1
52b55467719328bb9a3625bae3297af8effe34b7

SHA256
69d85abd8ba3ebd8fc05fad23946d85dd8f86657bdc4a36d0887fe666aee64ab

SHA512
c50542147fb66e734c0cef0aff1227ee4d52a8f3efa5b85efef365a49a0516c27f65672ef1e69e6d3c7beb58c749dd0e586b5c29847109cefc8b72f143fdbeec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aca83048dc19dd2504d8015621560304

SHA1
8be18d5e36cede3e27f2e77d76f1197a94bde224

SHA256
0b482ba54765caeb11dbd01e5ae4604d5004871fd2fb96ae062c3e625d181e0c

SHA512
1df6c7910182b15914a408d50052be0789797f768ed1d3200683d270159d07378a68361eb0d7e2d8a9db190a63d5c514b2f6d6792466d3b08d82496e740265ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
645b0f56c90135e0d7f874fd571bbc30

SHA1
383a137b3ff06e74851b2b88882a34ca75497a54

SHA256
4c99465e3a23519bfac498fb69846a61ff0da24ff092f205db4bacb138c34048

SHA512
67452fff3bd027d7ae54a74383bc800b4227b34394663ae58bc396c9cb335eebd1c60233d1fa4e10eb8dd358e1e5546cdfaa0864def5efc6a34ef9cf9ba7215c

Download Submit