hxxps://cubethesphere[.]software[.]informer[.]com/download/?cad5915

Resubmissions

16-07-2024 11:37

240716-nrj3pstbph 7

16-07-2024 11:14

240716-nb29cazcjr 1

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cubethesphere.software.informer.com/download/?cad5915

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
3688	msedge.exe
3688	msedge.exe
3116	identity_helper.exe
3116	identity_helper.exe
3452	msedge.exe
3452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 768	3688	msedge.exe	83
PID 3688 wrote to memory of 768	3688	msedge.exe	83
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 1812	3688	msedge.exe	84
PID 3688 wrote to memory of 4748	3688	msedge.exe	85
PID 3688 wrote to memory of 4748	3688	msedge.exe	85
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86
PID 3688 wrote to memory of 4848	3688	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cubethesphere.software.informer.com/download/?cad5915
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb54f46f8,0x7ffdb54f4708,0x7ffdb54f4718
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2224,14287865819840580164,13871169647372000131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
210676dde5c0bd984dc057e2333e1075

SHA1
2d2f8c14ee48a2580f852db7ac605f81b5b1399a

SHA256
2a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5

SHA512
aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4e6521c03f1bc16d91d99c059cc5424

SHA1
043665051c486192a6eefe6d0632cf34ae8e89ad

SHA256
7759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1

SHA512
0bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
203B

MD5
4345ae1b71bec5f3cac146f92eec2b9f

SHA1
c1fba1835cbb87b4820a514133c299f9a1e86b19

SHA256
66092587b2be113bcb0e202a71562ff18eef878b677ebc538b9f99c95f5dd232

SHA512
4a26c91219dda7bc1e2862ce3428036a7701dd6a604d74732773e73c1383128d9a5e93198c4fedd2ad78660a696ca7148e49fb32fc3bfe9ad91eeea022c9363e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e49c651234d63ccb49ece9079932539

SHA1
0e8e0f0c500a71c9882891155a500b608060d5a4

SHA256
177569f0bd7bed7e832510e50a1e39635c4132bee8603bb82b1f40e994f3b294

SHA512
0f081405fa9a5f6d1362ba8cc80b7fcdff3bbb7b30360cc2d8bae97369938ed0b45707552fcc38493d12141caf0c1207ef7c5b3819d321109dda49e9392ad42c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31914415777154eb60af4d56a846e3f3

SHA1
0fb8267988fea94dc23a970df680a7994948a7ff

SHA256
ff4e20ca90eb7cb9848446cfe431423fbb57dbc59f66f5d33a05ac026015a0de

SHA512
30bd055f4ecff9d5d64f0004392da8ec7988894604d922bbda6004cf99fc73d107bba39ca846751a206b037173001b1877e556d13cf5ce9ba1853b0c56dcb86c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0696af08fffcf8e7940ed65b8936adf3

SHA1
c7cbf29bd075b7a1f3838d07f378d54dc7843f8b

SHA256
815392dd27136a26cce05e906ed197b22b43cece639f34f668cb350dac99bbb2

SHA512
23dfb70513c8a4f6c507b4b2a26e55ac8a22e7a67eaf86b2b0090ca8872474a71356d33ffa7d071187204cc4be4f8b336778acae2268297603fbe48fe8195867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6ca7bd0bda29adada4b5a2d80008552

SHA1
8d7f338bcae2f240459f2eddebc7acaf14f97601

SHA256
43644f30dada9e84c9545a78974df09b398342f342165703dd49810a28f91e91

SHA512
506e11c9b48ee65f4e3e945addb7577b8b66c2063862436aef80a27ebbb60b2513df60c686c3142dfd76a03ed5161cc72196e1067a50d7ef5c0d8cc6b19f28c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e92e0f8d695c0c24741311fd279b3c8

SHA1
19ed5874985ffcaa00e1955e6966bec3236b9113

SHA256
b030e74f4aebeb1a74ea325f7b5af2971df875d5dbb4afc2d0414163dd9af26f

SHA512
498fbc007f17b7a9c1d72c72d405dc4e34dd1152919bb82ca313e0dc95805f624b5996f7857a5d86a9ea6ffbac4dc567e8b43e8d775978cd25bcd7a3e6882411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1d7d8f3b93c0796f50006e5ddf1dd12

SHA1
fde69f24df1e153a17d8fd08d570e2cd474976ee

SHA256
9087b911687f26fd82342b310a7ef5ac079ebdb40780c6eb5692c0549acd6b68

SHA512
6350893e979b3b257ddd20000b2b3e139b40249076a09c77c202d9c0849ddbd6e151f301230364a5e772df29d4681be4b8286d1332c84eefe7dd25ab4c3e3f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9cd93e9e6ee175ac61d4d80d837c41ca

SHA1
2bf897afeb25e61132862cbdaaeabbd641d04111

SHA256
dfe1e353651dc1e8e11d2210f64712d0f03153f32fab9e70ea5a54fa4fcfd2a4

SHA512
d119b06c2b47441a87413a138fb30cf0055eae480efaceb22d39ad4a3598b4c8d36554ae6341cf6101131eb74785962d5638d9d57ec30c6c1c2544ac6a73f0a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ed16498a36c16084f270517b23d8a4a2

SHA1
2b4500cf43287a5343ee28fc289725e979cd672e

SHA256
12d1cf7f489cd1c0c4fb4687a00548d94adf8064154c815c2cbe875ce270d48d

SHA512
f0d7c204dd91ae3541d4001eb9f846a05069384f025286fa6aa05cd85ea70b79a9c74db875a09492ecd2d686a867658778aca1c673414e6236419765912f4d26

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 459465.crdownload

Filesize
1.5MB

MD5
964ce9f128993eca502ee3dbc60fa659

SHA1
3f54e8bf96ad0ad24d6140c8b69bba501200d9e0

SHA256
65ad019de9c41e7b544f7b0d43cc196b933c2eb71ad6df74d1e08309d4e9b3a6

SHA512
5eae8768e6c6a7f3e3d2c3ea6315d796e14dcd534798b3ec6d74f37aa1660ee917484064bd8e1ef943214242157e7263e1716cdb5606f444c014402229dc36cd

Download Submit