a62e222ff00475992315916e906c34769437f7de055b025cd616e8f27231d9fb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a22ea94ba94fbe68002e06492bdb3085.exe
Size

24KB
MD5

a22ea94ba94fbe68002e06492bdb3085
SHA1

fee71c0ceaec6f631e0e4d58057cb259acb64d54
SHA256

a62e222ff00475992315916e906c34769437f7de055b025cd616e8f27231d9fb
SHA512

b15d27945d9ea904ebe015d29f2f48914e631a211e5319f8cf898ea568939aa37e5ebeab89eb43b064dd6b0483566227d0c28e118f98a598f6373fa9667f0b80
SSDEEP

192:o8YfrtPjuc+7/uEM0XuwxZUO9HsaDh84N+pX83D9S3ptl:o8YRPw/u90XuwxZXJ/opXSD9S5tl

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
1508	msedge.exe
1508	msedge.exe
1544	identity_helper.exe
1544	identity_helper.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3724	a22ea94ba94fbe68002e06492bdb3085.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3820	3724	a22ea94ba94fbe68002e06492bdb3085.exe	87
PID 3724 wrote to memory of 3820	3724	a22ea94ba94fbe68002e06492bdb3085.exe	87
PID 3724 wrote to memory of 3820	3724	a22ea94ba94fbe68002e06492bdb3085.exe	87
PID 3396 wrote to memory of 1508	3396	explorer.exe	90
PID 3396 wrote to memory of 1508	3396	explorer.exe	90
PID 1508 wrote to memory of 3340	1508	msedge.exe	93
PID 1508 wrote to memory of 3340	1508	msedge.exe	93
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 4728	1508	msedge.exe	96
PID 1508 wrote to memory of 3948	1508	msedge.exe	94
PID 1508 wrote to memory of 3948	1508	msedge.exe	94
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95
PID 1508 wrote to memory of 3624	1508	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\a22ea94ba94fbe68002e06492bdb3085.exe
"C:\Users\Admin\AppData\Local\Temp\a22ea94ba94fbe68002e06492bdb3085.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe http://www.flogao.com.br/lariix3
  2⤵
  PID:3820

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.flogao.com.br/lariix3
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb821446f8,0x7ffb82144708,0x7ffb82144718
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,1804612672005319199,17542177617841503186,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a65ab4f620efd5ba6c5e3cba8713e711

SHA1
f79ff4397a980106300bb447ab9cd764af47db08

SHA256
3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76

SHA512
90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
854f73d7b3f85bf181d2f2002afd17db

SHA1
53e5e04c78d1b81b5e6c400ce226e6be25e0dea8

SHA256
54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4

SHA512
de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
bd07c9c5289cb7b64ffb7a1f167830ef

SHA1
b996675453989a48a11d8f680ef2cf7f9ae4bef8

SHA256
b0568b9e65bc838d5758abffdc2a320e31cd8bbf9e021967016565a54f4cab40

SHA512
013d53484c10644352e303cbd43001f48b67638288c56b91fca6dd339f9302bc0dd6b3fde26926eeaf6ea10257194d7b248907991f534e342659f0cf1e1d98e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
955B

MD5
e2fc5dbe1b06b90cb343ad0a21cecb67

SHA1
8aef5ecf7e46a2cca6efa04a40d8d55a9d86f53f

SHA256
bfc6af113940a2e73d8b0d22b9665ce97830ca26c654c75d00d623a1b74dccbb

SHA512
340df4dccb21eb6274c636c9c55dbc7812ea3596ecb67dbc0d6c2329621a7c5d9b75ea11ae92bc458f0806765fe989c91c6d97877e6e91be359b7ff8a20a7627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6fef7431fcde2d98cab1d38e442e657d

SHA1
969e2dc7f49361e1cddd24a44d124c049cf9a9ef

SHA256
6e59be13347e08ed8fc12d819d7003062718dfbe318f046f545e30ae1399f878

SHA512
dbf89d0b7bffe4cd6e8456da264f291257c70cd94779dbe54238c98d69b633c0fb96e2232bc734f05f7a024a5015f9a649ce00f01efed7468a1f6fc242eb2ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b53f201debee781828d77fb9e593070

SHA1
6f8a262b8900c16c1bee1c34de19d7855e72bd90

SHA256
398a741d014c1d95ad1cd406917f9398afdccc261275275dd038cc51fb31cc2f

SHA512
dbd93efbb2497b09642720ebc8089725e531c03d03a3600f7b075ec9e2dec688125ef5788dd5e015515b5193d796a67e5e76adfae5fe6f93d75ba50ae83319d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7a91461dbb686f0631ef0a7fd8335eb

SHA1
ec2dd6a6de199551dc839a837a9a5bb85eecf70a

SHA256
dd275fbf43c05b271a870d1ae8dc1a0f4356c3ef8d9d1dc7c44c6ca0f575e4a3

SHA512
5b1105708494fcda832b4f4ff9ccfbd71df64a19ad09044a84cdbef9f456b85d8d9708a750a1161b35c9693157a9157469729446c1ddefc06e9409b29d51b657

Download Submit