hxxp://info@item-systems[.]nl?subject=Ik%20ontvang%20graag%20de%20nieuwe%20prijslijst%201%2F3%2F2024&body=

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://[email protected]?subject=Ik%20ontvang%20graag%20de%20nieuwe%20prijslijst%201%2F3%2F2024&body=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
924	msedge.exe
924	msedge.exe
2504	identity_helper.exe
2504	identity_helper.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 5024	924	msedge.exe	52
PID 924 wrote to memory of 5024	924	msedge.exe	52
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 4452	924	msedge.exe	87
PID 924 wrote to memory of 1976	924	msedge.exe	88
PID 924 wrote to memory of 1976	924	msedge.exe	88
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89
PID 924 wrote to memory of 3348	924	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://[email protected]?subject=Ik%20ontvang%20graag%20de%20nieuwe%20prijslijst%201%2F3%2F2024&body=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa2b046f8,0x7ffaa2b04708,0x7ffaa2b04718
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1776,6197521603619336146,8828207905586703533,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f6d41bf10dc1ec1ca4e14d350bbc0b1

SHA1
7a62b23dc3c19e16930b5108d209c4ec937d7dfb

SHA256
35947f71e9cd4bda79e78d028d025dff5fe99c07ea9c767e487ca45d33a5c770

SHA512
046d6c2193a89f4b1b7f932730a0fc72e9fc95fbdb5514435a3e2a73415a105e4f6fa7d536ae6b24638a6aa97beb5c8777e03f597bb4bc928fa8b364b7192a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4254f7a8438af12de575e00b22651d6c

SHA1
a3c7bde09221129451a7bb42c1707f64b178e573

SHA256
7f55f63c6b77511999eee973415c1f313f81bc0533a36b041820dd4e84f9879b

SHA512
e6a3244139cd6e09cef7dab531bff674847c7ca77218bd1f971aa9bf733a253ac311571b8d6a3fe13e13da4f506fec413f3b345a3429e09d7ceb821a7017ec70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c318128b2d1a0cef0cf499a906f4c746

SHA1
8348da3e742b772c7c7335f8e5a69ec88b98001d

SHA256
335941961ed1a1bf1deb4f68e9b3b2c204ff1bf6ac5be7458f2852dc75fffcce

SHA512
4058bf518708b02f0b4faca11e30888ba477ae8a9be390f896b472db8391dfc9703f50d30e2b701c1e93e0fa1a593593357a8048cb61103b712d05199847d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f1188e47211bdfc84287f6d2c19aeefe

SHA1
dc37aa0af20144f4498ce101f6d561db916da117

SHA256
a69526e0eb69ddd274273b92f18e0554cb41bdac202980e56c82b110e1a02f22

SHA512
aa3adaee576e3f28fdec05b5ca29a4726f23873e808a06a2d454d2e4403113414c5d491e93d543c0044a066f2d3100588fd024fe28555b7fb85d9a4c500d71a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9813fcb0b6d45ae7be4f0471f58c5fbb

SHA1
3e35b5a920e180090478377ef393802f7edede16

SHA256
e40f447c59a1bbb8d26b73de30705bdf38f730e4263c487b31614bd8ac30c213

SHA512
edc0aa4fc3b70a0b6222b615f3a6b98d1e78f77f1587f3f1f7f84c71f4375aadd7a11f7307a8cb935b302c14db0d55bb6d1e2d68db8c6fa699180261a3906e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
28cdad4a59be9de3a7e6174ae0ee5a5f

SHA1
43e13db105568cefc47d2f82cdbffedcec6b4a25

SHA256
753ed43abe536e3e5b069c9a76b66cb3ebd356c9a3ced1255b4e479ac7178b2d

SHA512
d5b7df9487f57a479beffbda07d8d896adf20e887f7f63c0c880aa546147a73df978b53da8249e032460ad4839ed3c6d20df0b4b610e9db93d4539bbb716eff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9257e9df20d7392a7f5c022981295595

SHA1
01e2b4f5618b25465704afa0a2c36689120ee782

SHA256
cc8335f7bd881f878eedecfeee31c509e426c3c99de2e30b87459acbd506c5af

SHA512
eac9b7a9daa26a53f150d2c610f09647efc9969798e815cf423c76e778ce4ea0a964608d7f5d305c3b0142d240f332ff3da9cc02215d5cd4d0f440b0f4c88596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d503.TMP

Filesize
1KB

MD5
4fc5840e4af29ce2b1952d93e0bf7906

SHA1
1dcf20f0aa05aaed9833e5f40ffc5ef06fbb7fbd

SHA256
03a92a432bb6c3ce72edcf82c275fabb97d60caa68507ee6b520398bfcffb02b

SHA512
cbd74302fadbb47639fdd887eefe5189bd4cdec7643151872f82354782f1cceb9ee2ad185da2b995a06ccc7a71b092f47ef4c4e022682c238e87b9c0231a461e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c49eace5-69a0-41ab-b647-abf7d92b13f2.tmp

Filesize
6KB

MD5
5e79511e6d7df71699820edc7d9583ed

SHA1
1a95b8100e1373c6dc5b02afd296ea427bf9c803

SHA256
4119d4dab8e9f4bbffb78f877b5c7bdafe5a1a3fa41803965770fad50e5d68da

SHA512
aa1074c6643bdb5693a9b97d2dd44f04bc5a0f965d0c2a120a2c54d45951773cd792fb89edd98d0f478d5f1a416c7b1ab3ed6fb2b960a1ac4ddbbe717d6c4ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c87172581a83a4f191c66380bcdac1ff

SHA1
b563d226af67afe17fdbb32c3b946970da905ecf

SHA256
e209737f990e00f61fa0d157f9f4d61be600b6e70c56c3e82281c058df393849

SHA512
55d7b31602c0be397c46eb30fde0033b78bd9997128cc76860df8cc0d5b41c13c17ed7bb8a0112fdf7449525d14d15e0df2d2a5a1758a3dd9907339ed2c4d39d

Download Submit