9bdef866d31871bc5806c3317771620dceaf4f698358120edb7defce731faa80

Analysis

max time kernel
144s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-04_9c2ea1daf35022f28c5e15419acc2c4f_poet-rat_ryuk.exe
Size

16.2MB
MD5

9c2ea1daf35022f28c5e15419acc2c4f
SHA1

55a795e709e4c11019e7c175c4c699c98bce60dd
SHA256

9bdef866d31871bc5806c3317771620dceaf4f698358120edb7defce731faa80
SHA512

1f71114181b5d71c8db6eba96c49a7ae743692887efabc80e144a47d17b1d062555e07710bad929340055d7febce7af90d47c0cbe5d86efe81a60afd8501b7e4
SSDEEP

393216:kMhF6kmfSLwAVaUnQXZ8aA1dJPAhYOcY9Kwp:kMHFnQiLJUt7

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	2024-09-04_9c2ea1daf35022f28c5e15419acc2c4f_poet-rat_ryuk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
2364	msedge.exe
2364	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3960	2024-09-04_9c2ea1daf35022f28c5e15419acc2c4f_poet-rat_ryuk.exe
3960	2024-09-04_9c2ea1daf35022f28c5e15419acc2c4f_poet-rat_ryuk.exe
3960	2024-09-04_9c2ea1daf35022f28c5e15419acc2c4f_poet-rat_ryuk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 2364	3960	2024-09-04_9c2ea1daf35022f28c5e15419acc2c4f_poet-rat_ryuk.exe	97
PID 3960 wrote to memory of 2364	3960	2024-09-04_9c2ea1daf35022f28c5e15419acc2c4f_poet-rat_ryuk.exe	97
PID 2364 wrote to memory of 1712	2364	msedge.exe	98
PID 2364 wrote to memory of 1712	2364	msedge.exe	98
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 2080	2364	msedge.exe	99
PID 2364 wrote to memory of 3252	2364	msedge.exe	100
PID 2364 wrote to memory of 3252	2364	msedge.exe	100
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101
PID 2364 wrote to memory of 376	2364	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\2024-09-04_9c2ea1daf35022f28c5e15419acc2c4f_poet-rat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-04_9c2ea1daf35022f28c5e15419acc2c4f_poet-rat_ryuk.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.hamrick.com/vuescan/supported-scanners.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdeb4e46f8,0x7ffdeb4e4708,0x7ffdeb4e4718
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
    3⤵
    PID:376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4188 /prefetch:8
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4188 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6815461532287661499,16237179237201345048,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4e764e03c1c9dc869c64752133d3833a

SHA1
c048d65937b11204bfbd306df0f7291cad4f8a13

SHA256
a1f41574fb78f911b71db00979c9f24979af63d566a5818c7e8195e4f2c62e53

SHA512
4697efe99a6782afc7bfd6e331b278b08e4424ae45a2025bf463b74b21feb63f9104e89b043251e3130f328072c0262edd3934812b62758ecd82b5534b9b8328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
601B

MD5
2758be9c1204133e9a812a7348e68b23

SHA1
759ab988be35e6bab69612121095bea00bac788c

SHA256
2b750c314456b7929687fcb136cf8eed41440c33a3cf70584c803a42a43d7229

SHA512
7929211a1c45aec9caa3faae99607d8f19f7ff9816b3b0f7b1494a35c77ade371646189074d9dce8a33e520ae808d3e73f62d815c3fc779efe56c8df38ac10e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
844b301c009d0d627584dca3c9a5729d

SHA1
f302a7c68da24bd009d73e1fb18e9bd447ffd7d4

SHA256
86080c5a52e0e4644d988214ff84ff0d43d0f793c6dd0a2657d3729967d07b70

SHA512
bc4bdff74ea33ca5942739c429ddff7056b4086dcd22a6d576208b071c1d3bcc985f2621f2763258d7673dd4a679e5c845a89a6f15e42b2a1c1cec4a1523f4f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37ce8db5eeaa33d89b6cca0e6df5b7d9

SHA1
13e994a0b0ffd6fd6ee2334752dc24adc1f10411

SHA256
773fd3aed3a5901524c2702e819143141c0083bb3e9114e5fff8462eab8ac8ae

SHA512
3a31786fb78f2d56a978752efe706b24fbdc77adf00fefd7d5433f3b415dd44f6b540e941f15f0bc7676f920b95bffec97648c4f496ec7f11384f8d324e1173c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2831d4f15265ea5a8b510278111a6563

SHA1
3ba9d6d3006c33e9434be17a94540cdbdf135662

SHA256
bf5cdcb1d36927a5166ffc6b09f7fbf1cbee52505a0cacaa5958069a2051a5e4

SHA512
ef4acc77c13608f8da085941ed26d42eb2dc90770682a26581c73257eb58a24ee2680956b9d9cb8cda06a547d1e3e544f7e36015340607a818d460b149475e08

Download Submit