29ec679c31af3f8c32c4385a538e05807985a5ff2461e466d08742364e934749

Analysis

max time kernel
1699s
max time network
1703s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
11-02-2024 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winrar-x64-624.exe
Size

1.4MB
MD5

cf5c029c1f3068e46ced8280778367c9
SHA1

d9971b5a80b34fa512ff1302e373901637b63777
SHA256

29ec679c31af3f8c32c4385a538e05807985a5ff2461e466d08742364e934749
SHA512

6f72c616ea21076d984904be37ab8d219d734ef95cd441a47abf0d21241d6ccaa32a976114d85a708f4606043d946c1281cce29517c62150daa6fd8e76429615
SSDEEP

24576:AeL/FJA/3MWSoCxm1DbJK86rSdwcSqp1V0nUXfnRu2kZAhJXfeWCTLpXph+eDBk1:AeLRoCo1/oej6nUX1wwuL1u

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
3404	msedge.exe
3404	msedge.exe
3696	msedge.exe
3696	msedge.exe
2892	identity_helper.exe
2892	identity_helper.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1028	3404	msedge.exe	83
PID 3404 wrote to memory of 1028	3404	msedge.exe	83
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 1692	3404	msedge.exe	86
PID 3404 wrote to memory of 2036	3404	msedge.exe	84
PID 3404 wrote to memory of 2036	3404	msedge.exe	84
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85
PID 3404 wrote to memory of 3900	3404	msedge.exe	85

C:\Users\Admin\AppData\Local\Temp\winrar-x64-624.exe
"C:\Users\Admin\AppData\Local\Temp\winrar-x64-624.exe"
1⤵
PID:4624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcdbee3cb8,0x7ffcdbee3cc8,0x7ffcdbee3cd8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,12261522190229718438,14956281296886645722,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
05ed8d7350c6abddb2413582af13b728

SHA1
98b3e6793352038355ee54fc58828e5ca1cf0f77

SHA256
878b0ffac96b1428cb415ab15b289258dcf9fc175ac2571622e4dc1219f32c01

SHA512
b80bf631b56588daf08570c05aac9a67cee414403149c223a005a7dd9c81b5e8d4c6f175815106f039d47c1bfef875ecbf65efba106d5107b137f2aabe446058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
a1517b2570689ba97ec104b0b7f1e38e

SHA1
856d8987e04377305ea8926b90b935e0978bb3e5

SHA256
66d0f8259c5c0a25ecefe4ea4f5435a31eb7cd815bcf76f15e2e974b4d0809f6

SHA512
74ae156b44562c0b734fa5e7776d79f51e0cbb40b6227a43596abbdb8f80ec77c457dfc74bbb7be9637570be7bc29c8d73004226f44a0d30eb81f002a591901d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8797da30680ea6d23041d142249bf31e

SHA1
aeb045dad95486cdf77e4ad804419d156d881381

SHA256
c5e917cb110df177b548e09cbd7084dfc8f471cf0c073c27a5499ad2a9eba3e3

SHA512
fa5a0bb9459bce27faa97f6d422a35c4e353e229b534c255266051acf780f2154fd1ff7d02cf8688470c91b41c58c122d4663b9193d3c9352525f4972de10859

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
254f2aea3f64df027f0ab1a35a02be84

SHA1
cf382759b1c1db09b7a29229fad9f77c82bffc0d

SHA256
b85d46b15864afdd2fc505cef89d200d4dc495383bbdee48bb2480f16bd3dabc

SHA512
77fa0f3ca114a1f09ba5ef77ed73896455f000c2461e844b0579326a5bb808beaa280d17bc9f301ff49da6afda42e7a775aa2c0bffed6e6491222a4188fcce4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ffe90299b768f3133f77570f7c09211c

SHA1
f8c582231d1b719878471341dc9f0c856e28f1d9

SHA256
3df20c5fef1b8b479b7a95bbdd6b9db8f7fbc5fb1ee7cea494fcd3a68c3db4f6

SHA512
02a6ff8f70a054bfe53afcc74927aa977954424611fbe3d8943f86552eed05888b6b90f84d93ef27bee39745988a1e58fa14b436687dc434debb9a8217cd9c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
3da3cf652acf7e0fee298963e8cb77d3

SHA1
8d35e8ba0767c10324335e8fc8f5c422ece4e504

SHA256
9b436ba7a14d3947bfe73fa9bd581f6fbf0acbf26e97a3a54d6d032d19f8cf64

SHA512
89e9555edd366fedaf79bf4c6da816a69fb220c987337369511c4422034cad486338a261eb6954d000dbfa636c969d04b65de62bb6df9c023ca5e11c892ee83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
75ef0727c72214eb0c63d14efd25d64f

SHA1
0b4ac9a4f45296cf2df1edc67eb945e17e5fdc01

SHA256
7ca88d165c2252917fe99ac817ebc17d78883184a54c02bb4ed241fa2de69d8c

SHA512
d66ec28e7bab16212496b1e083599c2ed57e7bcc7c26ccb2aed49d678079cd42a91d36d705b337170da490186a755ea0a79b08f570400cce124de0e507dbbaf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6bec15dae6cf4ae818f12850211e0af1

SHA1
6245e9852921d73188b6ce28407c18e70f30501a

SHA256
4e2d0687562d83ffcce56463a92aff55b6c7e22cee162757a7cfaa5739f1a726

SHA512
1cfd78661f058c25e00103b355d22e190441ce2b01010ecb498766ec4a89060d9a46ff485a1c04402d16dee2627e11c1b6133269add71fedd22ada273923a4ed

Download Submit