hxxps://cloud1[.]appzen[.]com/console/userInfoRply[.]html?token=373577520752660390517243439706593718109&rsf=HIGH&to=Ronda[.]Burrell@enthalpy[.]com&from=noreply@appzen[.]com&rid=131206766&rnum=EX-213674&emp=102873@enthalpy[.]com&comment=We+cannot+use+an+email+thread+as+a+receipt%2C+even+if+the+total+is+listed+at+the+end[.]++Please+complete+a+lost+receipt+affidavit+and+attach+to+this[.]++It+will+not+be+approved+this+way[.]

Resubmissions

28/08/2024, 22:56

240828-2wntcasfmj 8

28/08/2024, 22:54

240828-2vkqas1anf 8

Analysis

max time kernel
101s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cloud1.appzen.com/console/userInfoRply.html?token=373577520752660390517243439706593718109&rsf=HIGH&[email protected]&[email protected]&rid=131206766&rnum=EX-213674&[email protected]&comment=We+cannot+use+an+email+thread+as+a+receipt%2C+even+if+the+total+is+listed+at+the+end.++Please+complete+a+lost+receipt+affidavit+and+attach+to+this.++It+will+not+be+approved+this+way.

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
4488	msedge.exe
4488	msedge.exe
5116	identity_helper.exe
5116	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4580	4488	msedge.exe	84
PID 4488 wrote to memory of 4580	4488	msedge.exe	84
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 2228	4488	msedge.exe	85
PID 4488 wrote to memory of 3996	4488	msedge.exe	86
PID 4488 wrote to memory of 3996	4488	msedge.exe	86
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87
PID 4488 wrote to memory of 4360	4488	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud1.appzen.com/console/userInfoRply.html?token=373577520752660390517243439706593718109&rsf=HIGH&[email protected]&[email protected]&rid=131206766&rnum=EX-213674&[email protected]&comment=We+cannot+use+an+email+thread+as+a+receipt%2C+even+if+the+total+is+listed+at+the+end.++Please+complete+a+lost+receipt+affidavit+and+attach+to+this.++It+will+not+be+approved+this+way.
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeed946f8,0x7fffeed94708,0x7fffeed94718
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2584499888489881560,15687911578333675555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
c7b0ef197d06c1a3a5f0faadbdf44aa0

SHA1
95b415dbae48e048e9a38ac34247e8fcb8f30a7a

SHA256
c7ed2923b6786c2a97a87605e382e7156582b78771ebed0b68e26fdf81db9acb

SHA512
3554cc4cbf97f0736c90d98526d300aa711a193cfc64452c10fb7125e2e6b9c4fbef79646eea2610a7509a84095751f08faa3e131fa1e2177103614e1faae182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
671B

MD5
5109775fe97bb123909f96c94adb4f1d

SHA1
712b56377d85018944948d57b253a9e9637cbd24

SHA256
725255ece2a1e73c7333573bb6569d86108b104ca4512eff8a4cd5c33525ae7c

SHA512
ea1ed35d5fb9bc7261a64670b94e8fcb5527b060d3476a6e74235df08e0e245c0d17fcfdcecb89bebca8e77c97d43c4918189a6721c43251da91dbd2a9684289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0af73e5d80240c1bfb6a62f89c399bd1

SHA1
53587111a6d5be5348af9e46eb1d3ca31219131f

SHA256
7444cbd2d7464d0f25651fa5d5c813bbce4150603e9f9cb942e4aed01aebdc9b

SHA512
fb681d61b0c9fdfb962cfe57660645c72964cda624bce0a1e5316c69cf4ab86af4237ae6e9aa917892999e5947592dca0e4a877c18e16f2a6bf1d3b752680fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
89893bb231297b445783ef8450c1e5d9

SHA1
f51db5f6155459db1911e9d46fc438be97e74772

SHA256
b62ec9221c3fb6d1fdb76729229009aedf72b4a9a2d6aba53d1d4cae5a2f4d13

SHA512
3665b931bb01ada6740973538afa27ab6db1bae64ae53f25817315bd2bd9e93fc3c80f2914d06990abbfc7de8c3c429cdd9e0c0f9f85ee5842ebbdb9ca405d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0fc64b6c3ac9c6c3f233660494fc431

SHA1
6a53ed456e49d132f4fefbc73a01e7f2668d1439

SHA256
f72f70efc4fa26d652803763c1285415d9587493974cdde2464e5a232bbc5ba0

SHA512
5b188a60697abf31887c8cca52fb6169b0bdbee312c8acfc9b83607ee5cfe6659d6503c123c489f890bb5f3f075c6a37fbb5f18192eba7e70c79c39f960b1554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de83ae41a23fa22e6cc8c4b7fbe034c4

SHA1
79ab4da747c03e6e4a89d34e3adeb5390ee298b6

SHA256
ffb0606aed17e2f26070b53678dba4bbd292aaf65f416d672db11676500c878e

SHA512
55a879ef2594071dc9684aaf263363552003296638f31cf8bc3777ff9d327bc047120a558ba056da39c07d9c96ef8874657ccaf7364dbf3df53c10b6df800df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
85d54f0847d034cd7d6d737baa19a90f

SHA1
a5e557c60941c83d85d8efd960750cd91f277a12

SHA256
defba08b936976ae8b4bec1c7c4864ceb4fad01a3e64be0bb462f26d838bd3b5

SHA512
0315e0bbfbd6aadb22bff4a6d1aa4a18bcae46b29cf3362bb57f03da9cfb875f12e5126e2c8b126c412906c8692ed7e848e9ed9354160fe3fa9db1161a97fc97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d486.TMP

Filesize
371B

MD5
6fcd729da24666b4addb4ec72f1c7fed

SHA1
6c7cb6500a934ab41b93cc5224d599386f2ba574

SHA256
25336597b9d374c465a2046fbe0b250864e6b0507302bdacbf274240ad5cbd23

SHA512
6ee449e5427574d38cd957420d613b371f733d10df28ca389883b2bd3c4e50df3cbe084415b7992fb548f8bd66f49c216e9e136101f280c00eeb3f405ccf10ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
786bf6d1ab638911d9b234fb993c1531

SHA1
57e794bf41e365d8d2be87f9acc21fd3eaa0bc1a

SHA256
439a30858a5b285aa3c19d6e02aba76ba01d20522ee71d1d910d8fb0b204b349

SHA512
518cd19cbcc513971da4d3ba11861d92f58dd7158fb0238f087d7fd63984657ae585c51e0478ba53b8fa67f10baef225081aad4b540a21ea42bba76c5faa9216

Download Submit