hxxps://go[.]eu[.]sparkpostmail1[.]com/f/a/TeZdKDVSihVahrYyiCrP-Q~~/AAGCxAA~/RgRpNb0OP0QjaHR0cHM6Ly9sb3RhZG1pbi5pbi9kdWUvY2lnYW0vaW5kZXhXBXNwY2V1QgpnRA44U2evTxxnUhJ6YXJnYXJAZmFyaWRlYS5jb21YBAAAAAE~#b19jb3JuZXZhQHdhcmdhbWluZy5uZXQ=

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go.eu.sparkpostmail1.com/f/a/TeZdKDVSihVahrYyiCrP-Q~~/AAGCxAA~/RgRpNb0OP0QjaHR0cHM6Ly9sb3RhZG1pbi5pbi9kdWUvY2lnYW0vaW5kZXhXBXNwY2V1QgpnRA44U2evTxxnUhJ6YXJnYXJAZmFyaWRlYS5jb21YBAAAAAE~#b19jb3JuZXZhQHdhcmdhbWluZy5uZXQ=

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
3288	msedge.exe
3288	msedge.exe
3552	identity_helper.exe
3552	identity_helper.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1888	3288	msedge.exe	84
PID 3288 wrote to memory of 1888	3288	msedge.exe	84
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 372	3288	msedge.exe	85
PID 3288 wrote to memory of 2252	3288	msedge.exe	86
PID 3288 wrote to memory of 2252	3288	msedge.exe	86
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87
PID 3288 wrote to memory of 4188	3288	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://go.eu.sparkpostmail1.com/f/a/TeZdKDVSihVahrYyiCrP-Q~~/AAGCxAA~/RgRpNb0OP0QjaHR0cHM6Ly9sb3RhZG1pbi5pbi9kdWUvY2lnYW0vaW5kZXhXBXNwY2V1QgpnRA44U2evTxxnUhJ6YXJnYXJAZmFyaWRlYS5jb21YBAAAAAE~#b19jb3JuZXZhQHdhcmdhbWluZy5uZXQ=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa303246f8,0x7ffa30324708,0x7ffa30324718
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,11239172553018778002,2210288016928802106,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
fdd5ff3997f214196debcaf25e8f663d

SHA1
82effbd6a5374fffa71e7db3bf897682324f5f8e

SHA256
19ff2eac10c966819181e19c62c74f6d3ed74d503f2536b66aaf28d1c3248dd2

SHA512
62fc68c2bacc35d3ce00ed5c3b818ea383880b31e0ab9624565d92989d152c64cfff429096e43b556ff6271c985ba7d72b166e7eb2a5b84b84e9d9fa580dbd99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
890c700886a676a95e59dd74fb625aa9

SHA1
61eec90086bb3005c58c93b48f2508ec6f422704

SHA256
663e30c49459d51f492177d56ba8ae9f40d00382ef294d43f249bf00273a30d4

SHA512
7a494d625a29edeac53e2279a0bdee84213dc8813af2503b47b87001eefb601e53e6c7b969c9ebad69740976ede7586483a96989dedb440a4df18951403bb033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21a545666444bdc229e326f54eeb43d1

SHA1
1510ba5259a39dc1c466bc23fac7878209a95a93

SHA256
702bf5789721391a33761fab3637746fe9f2c00ae12bc78e1605034f8e06dbd0

SHA512
1419bcb4a7a61bdec9201fcebe879bd464b9ec90e999d75be49a4fee0be4c923794634b2690bae7fdb2a77be70f96ea9e9045cef969f0e594ab7ca30b3ab104d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8e3191e83052fc10d749f66600a4c522

SHA1
48dabcaadf27d948fdcaaeba724f1409ac2c8b98

SHA256
0f9f36b3d1fb576a8a0ebdd76c86e7e8fbf7b87d2d37c37182835df73be380d4

SHA512
5fb95ef37805c5128f7dcee478e67dd5f1285510ff64493d92059b20e5541a2ab4a6a4db8e394bf0ede3a6a6bedb8af6c5da5edd14391fd3f39b8e9eb1992663

Download Submit