hxxps://coralmc[.]it

Analysis

max time kernel
149s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
21/02/2024, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://coralmc.it

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3268	msedge.exe
3268	msedge.exe
3472	msedge.exe
3472	msedge.exe
3732	identity_helper.exe
3732	identity_helper.exe
2924	msedge.exe
2924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 1100	3472	msedge.exe	78
PID 3472 wrote to memory of 1100	3472	msedge.exe	78
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 4116	3472	msedge.exe	79
PID 3472 wrote to memory of 3268	3472	msedge.exe	81
PID 3472 wrote to memory of 3268	3472	msedge.exe	81
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80
PID 3472 wrote to memory of 2036	3472	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://coralmc.it
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f2d03cb8,0x7ff8f2d03cc8,0x7ff8f2d03cd8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,1697060616204671421,15804852476389407695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a91469041c09ba8e6c92487f02ca8040

SHA1
7207eded6577ec8dc3962cd5c3b093d194317ea1

SHA256
0fef2b2f8cd3ef7aca4d2480c0a65ed4c2456f7033267aa41df7124061c7d28f

SHA512
b620a381ff679ef45ae7ff8899c59b9e5f1c1a4bdcab1af54af2ea410025ed6bdab9272cc342ac3cb18913bc6f7f8156c95e0e0615219d1981a68922ce34230f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
601fbcb77ed9464402ad83ed36803fd1

SHA1
9a34f45553356ec48b03c4d2b2aa089b44c6532d

SHA256
09d069799186ae736e216ab7e4ecdd980c6b202121b47636f2d0dd0dd4cc9e15

SHA512
c1cb610c25effb19b1c69ddca07f470e785fd329ad4adda90fbccaec180f1cf0be796e5628a30d0af256f5c3dc81d2331603cf8269f038c33b20dbf788406220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
8296041c1015fce0b7de236d58d86986

SHA1
8e97c39cbb3167fbfe317606c0ad1abbf42746b8

SHA256
295306b55857565c4849533eb0aed9720ca59d601251d75e81369ae00b024bd4

SHA512
efa0bc6f9d4e93082f7f883bccb9afa90be871637ee0c54ceb209af3654ba40b8d0e0eb791d744054ba8033b489ba3f170b0fd85aac5afacf78c55b23864e02a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
144b5c6187fd035fc36e75699765ad29

SHA1
beb3f079030d2a44e794ea7826c6c9e7b21064a7

SHA256
3311b80ed87d6d961b69a9f2d78de5288384ad14e22cab02d33f4fda3371e9f8

SHA512
c4b32e17407062b50591764736f9f02acd91c46c51965f663bb02b56f1c799cddcbb01d6f2f7abc533835befbc5bf20e66998b405ead27a144bca86f0ce7abe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6700254a616ac78cfdd06d94263095ef

SHA1
644934a0b65fea507ccc317107cc0c0079008689

SHA256
b0fd56a5c5f062e4dcbfb5926fd874428db0426e01627c730356502baf58ab85

SHA512
4fa26b32f458a5f2f3365e1e60846d2c544763963c74ef852f5117bd456cd4f3e83f7ce42a5524013e56eaeea8d0920151f216bd259ce385d313a70babfa45a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48522bc2798253c1cdeee2b3803c3547

SHA1
fa9494d080b526e5bc3f0ce453326d4e78bcc73b

SHA256
9140acc1bf8ce953c754345e2d1eda9d7926a53b5d5acda30b7cef2e8f87ffde

SHA512
db74550b5aa70d945993db7903585ac2153c727992db07a49ee5e9f64dddb1a9923a8471a7727b62d1d670fcda0ee51795ee1d473ebf6fd1144ad190158cfff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2222a89bc2bdae70be94f2aafe135696

SHA1
523eefdd4cffa86fdf3200dd1f7f360e85680030

SHA256
3abf834bf54d800fb337817558e286a31501a102019d4dc85448ded02024e5b0

SHA512
11debe3747a499a18bfbb3506eb75bddb067d47c2ae5996e2f61675c33e86cac0d7594cef25d58861d8d342b209ad706347166b5595f8ef1980159b7347c5a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62580c9f75f5f6369bfad686afbab5b9

SHA1
19c8c19e53e6de1e7142d90090c88a4937b4eb8d

SHA256
1be5e203c9fb4dfa588bbafcd095964779749c207aa5f6a1b890f95a5ea76f0a

SHA512
681ba1e528dad2a3f16e4788219ce4ff03f531e296f00ba9c471195317f752aab0c892d9ee7e5ae34b41ea3aeae46955a2a4a7bbd5526027c87b5689e2b47a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a639e50c551bc1b030389bc392ed674a

SHA1
66b8b77999736f922cfb2b709f718e084d4c78ac

SHA256
c449113479433dd9b4c8dcf7b79679a39640ef6c8b7143d9cecbc436fa29e8fc

SHA512
e67963fcef2b9207ee1a37b2136e58df81429c27e0d430e7ff16e382661a45ecb045c52bbcaf97104b6c1f0783c8169507d087d2bd57bd978552e156a22af757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a1328ed6849fdca82050bb9aac1f3bdc

SHA1
ca2cd6b6c24d624d8c96cbb6375696640c87eb3e

SHA256
a095d5f78ab1c8ef6a516eaaf6bd634eb10c9d77c6a5fabaaacc42128899cf05

SHA512
072e9fc496c355c3465077cd920ca45d4a048680fe2acca52e4246ea2fb7e210d87cace4860834d3f30087f86c8330a6d83965619ef541fa61de42ccea422665

Download Submit