hxxps://cdn[.]discordapp[.]com/attachments/1229470624192139274/1229470656798654596/ArchiveFix_2[.]rar?ex=662fccc7&is=661d57c7&hm=88eb6b82ab395b26e04360695e94027be6b74ae8cb1c5106e0b0a9fbaf12d9b2&

Analysis

max time kernel
27s
max time network
29s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1229470624192139274/1229470656798654596/ArchiveFix_2.rar?ex=662fccc7&is=661d57c7&hm=88eb6b82ab395b26e04360695e94027be6b74ae8cb1c5106e0b0a9fbaf12d9b2&

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5920	ArchiveFix.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
1628	msedge.exe
1628	msedge.exe
2120	identity_helper.exe
2120	identity_helper.exe
2920	msedge.exe
2920	msedge.exe
5792	7zFM.exe
5792	7zFM.exe
5792	7zFM.exe
5792	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2600	OpenWith.exe
5792	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	5792	7zFM.exe
Token: 35	5792	7zFM.exe
Token: SeSecurityPrivilege	5792	7zFM.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
5792	7zFM.exe
5792	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe
2600	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 692	1628	msedge.exe	87
PID 1628 wrote to memory of 692	1628	msedge.exe	87
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 2748	1628	msedge.exe	88
PID 1628 wrote to memory of 4476	1628	msedge.exe	89
PID 1628 wrote to memory of 4476	1628	msedge.exe	89
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90
PID 1628 wrote to memory of 3920	1628	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1229470624192139274/1229470656798654596/ArchiveFix_2.rar?ex=662fccc7&is=661d57c7&hm=88eb6b82ab395b26e04360695e94027be6b74ae8cb1c5106e0b0a9fbaf12d9b2&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6b5246f8,0x7ffb6b524708,0x7ffb6b524718
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10900269748378725632,14440505674896744112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:1876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5556

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\ArchiveFix_2.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5792
- C:\Users\Admin\AppData\Local\Temp\7zO0A6639D7\ArchiveFix.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0A6639D7\ArchiveFix.exe"
  2⤵
  - Executes dropped EXE
  PID:5920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e7634e798c3d55d16423a1fb1a11efa

SHA1
2f642d569417c0f77d5687cce0fbc5db40983f97

SHA256
f156def6356c270e0edc674a18e45aa6bb0555612772df1ecf793669647bb1d0

SHA512
2eaf3652fcbb0dfe75e070d386503025301d3ac18f437f72778f75b74233987d103d504f91f6f6fa05ea872cf90a701c5294459057561da4c5a94626c98857c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5210d06b84b5c48657376ffe83c43551

SHA1
91c1dc9af20d7bc9496194e2ad713e5176076cbb

SHA256
995618070f11008fa2ae4b60a553c70313dd8ffadb1fb17b17f630fca056519c

SHA512
abd7bec7d1a58a14ce17e0322967122f011061634651d8d7d1537b4df6012313df4517b8f5190d3550a8995a2611d6a7452783ab0e422b110d5b325e07311973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6e93d30156d2db6a115a55c7d98bf07e

SHA1
0588abee6f2f81b25d38c51bed108ae055b2ee84

SHA256
c53f274c925687c6cc17158c22b50ea2efe3eae9c3eb7bf60ea37538b478709d

SHA512
bca267b1225597e1e68985bd9d04353d58b4fa95d4324914cbf0834e41e1490dd5e77d94f5b41d9c9778b268317a7988efb4073f0115553c29b785661f224f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14752b16c805e416aa2ac2e8e542b7bc

SHA1
7b43e857bff75f7814bbdde4dd8a08741ac4b27f

SHA256
a86ba31dbd49f36a9ef806617dda01a071d75df074dfb46e2ca456718961679f

SHA512
415df2f9726d47c1e4bc25d8ef560fdc7d774e30de385ee167f3175c1ef954d152f4d41249fd17c9b2929816e0111683449d68429e646d68277d668bb83edbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO0A6639D7\ArchiveFix.exe

Filesize
666KB

MD5
ab51890f4178c5a32b4f3f4bc28d79dd

SHA1
14c52c649e102e209d75b40f9f90ac2219d9fb2b

SHA256
83468b4f222ae516fa288f4cc3701950ef6b6a6af23f15dc676b915773941575

SHA512
0f54b66a2a5c6f128cad619221c2e6124fb4bf2e69a19c7b6dbb65b679d9a934db54f81d15aefcbe84963fc032b0a001191d75f6f8e3c9a74476cc337d40b5bd

Download Submit
C:\Users\Admin\Downloads\ArchiveFix_2.rar

Filesize
901KB

MD5
2e6f5f6792b389444105849e5d6b6afe

SHA1
a8b8810795dc58b6a438a8469361a7d33e365692

SHA256
0217e915e5b28527fbb12660e05fc7cf0716b2566b806925ed0d8ef2e9a69a26

SHA512
ec73b2a44eeb770e063f26a2677d8e20bd044f430f91bc942a671c434eb5caab0fa714d77b30f7efff62f74ade3f74ac5acf110b157ae335495eb07db9c3beaf

Download Submit
memory/5920-98-0x0000021D60E00000-0x0000021D60EAA000-memory.dmp

Filesize
680KB

Download
memory/5920-99-0x00007FFB56EC0000-0x00007FFB57981000-memory.dmp

Filesize
10.8MB

Download
memory/5920-101-0x00007FFB56EC0000-0x00007FFB57981000-memory.dmp

Filesize
10.8MB

Download