5e57fdc84d36af1d3b787eded2533985dc19f63d3ede1e71950b1235886f8332

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2023, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MH71 Installer.exe
Size

439KB
MD5

094aa0eb3db132348242687fbaab8ee3
SHA1

d3338ce29aa68747b10ddc71d1c3ac0ea29c57c4
SHA256

5e57fdc84d36af1d3b787eded2533985dc19f63d3ede1e71950b1235886f8332
SHA512

c72a7555cc76603a5a8b7f103926cdd58ea0591fad0425732641a647706034b370b71f779aadedd4522f4f1657d4392b6cad966a7ebc9d7f7c8b76dda8c7bf6f
SSDEEP

6144:q/lnYIy+wqgrj8vJyGjgzhHov+6UNlcL30Nxb48LAOvxuVTSLlirYtr+9mHOaPPF:q/uIypPARyGjgzhH3xbbJ1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3932	helppane.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3932	helppane.exe
3932	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 4340	3932	helppane.exe	97
PID 3932 wrote to memory of 4340	3932	helppane.exe	97
PID 4340 wrote to memory of 4660	4340	msedge.exe	98
PID 4340 wrote to memory of 4660	4340	msedge.exe	98
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 1228	4340	msedge.exe	99
PID 4340 wrote to memory of 4124	4340	msedge.exe	100
PID 4340 wrote to memory of 4124	4340	msedge.exe	100
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101
PID 4340 wrote to memory of 4192	4340	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\MH71 Installer.exe
"C:\Users\Admin\AppData\Local\Temp\MH71 Installer.exe"
1⤵
PID:3056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4812

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8e2f46f8,0x7ffa8e2f4708,0x7ffa8e2f4718
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,5511885288957197601,14792233251305247735,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,5511885288957197601,14792233251305247735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,5511885288957197601,14792233251305247735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,5511885288957197601,14792233251305247735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,5511885288957197601,14792233251305247735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,5511885288957197601,14792233251305247735,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,5511885288957197601,14792233251305247735,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,5511885288957197601,14792233251305247735,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:3268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8c9383861d9295966a7f745d7b76a13

SHA1
d77273648971ec19128c344f78a8ffeb8a246645

SHA256
b75207c223dfc38fbb3dbf03107043a7dce74129d88053c9316350c97ac26d2e

SHA512
094e6978e09a6e762022e8ff57935a26b3171a0627639ca91a373bddd06092241d695b9f3b609ba60bc28e78a5c78cf0f072d79cd5769f1b9f6d873169f0df14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c5d5a38-699b-4f7d-a469-4d2623036dc3.tmp

Filesize
24KB

MD5
60b345592703258c513cb5fc34a2f835

SHA1
39991bd7ea37e2fc394be3b253ef96ce04088a6d

SHA256
7e358b4f7553c9385e8eb2c5692d426bc257bbd4c0213e6c69294459734f6300

SHA512
0346fb4096eb285ab0fdf7e7ec38c4daf7bbb0c506f09975eb2290121d169a34c886fca342c3e06371cb697f2753a697ca4f72af7817ed340eee6063897110a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0391190f1d4b60407486f64c70aedeb1

SHA1
c5113e53da40a712afe5e8d28ff27dde5761289c

SHA256
8d48fa4f7b4e8db11176e05fd2dcdded7c17943b1200aff7729674d7b7ede4cd

SHA512
a60c3b210036cfd41254c65c3dc2cae5458744bb076d236b05e3c60e776579aadb316b1203a4ceeb18cd1306c10b8c4c50209d9fa9710067d879b950a3856603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
bbf968475178f6e9402db09bf7faec64

SHA1
e6facfcaaeccc9cbfbe38619777621fe376ec30d

SHA256
b477450696c1e3390e956879f51c81cd21c35aede147b880d06b534c7640c78f

SHA512
2be53f03b98349e85a05a4d09f851332fceedc838cf54ac8b9cdd165fe243aa411f288e861cce66394e9c8e5c5c68b26c9ce3329101839f9be0e36703f8ef00a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
9abe6f1b69c5127b0c66fa5f65902ee2

SHA1
8eeb13447f0bd5be757274b6f85cc165be809ad6

SHA256
091d87efb41ef903390839497745711fc01b9c830a077258c2346eb8a6f7775f

SHA512
0f6b37bc2178e5ea4345ebbe44ec622759123ebaa73387605d49831ca833bdca9b59a4b3fb8117925160f238726b086a2eead144ac0b7e253f242089d8900405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
396B

MD5
836da9d09f7b43127fafef59e0c2e7c7

SHA1
8518d101c7c82ef38c977101bec65b7724d9c08a

SHA256
51a808c834d00bdc91ffb56945c301851b0bd073bef016431e490fc628aa71f3

SHA512
fd541ebf3f9bebf38e7836a468649e8fc01c8148f43508337e98e2ab00bb33b5b9e925b4ab7e42bf18c9f9788afcfae3c712b683c5cecf53b5db3b42d6887d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
88d55b3a27885e1a013fe1bc68728328

SHA1
8db718779d1d3f612f531cb5f4418d1d886042b9

SHA256
d6efde256324b6b89603218150a6efde5bc7b175036a1665846437ab083e2730

SHA512
d928e49e8c08b26a11bdd28c72873958d5becc42ac65fb807399da4f58ad3b38ef41cd8b9062e00abd05f161c3ce3c649f254c7a62664dbf7d3960014652c26d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06b7d16618cbf5dc62761063e975145a

SHA1
33a721784398b709a2c4a9cdd82b2c4e105d996b

SHA256
014de4c8bbed2d8bc84500f3784dd60111c41ccde496b9bf7f89815818901277

SHA512
7a24e1bd5ce8e88f37c222c5cbdf2688cf486af9b7a5518686bf6e5839b89e6311a7fdce7c66ffe910a8dbe8e5e1b3162f551d7126a5273f591c5ac958f456ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1e5ba0451ff36f3ea9e13836ff06ff26

SHA1
29d9432a220b56a8aff2ec973bd6006dad895117

SHA256
be939c53dedb05948868aab0d04a7a31d9883884262e1da601e23cf95ca80951

SHA512
10247ac659e1ad79d1984e617f9ded79cbddfe9c69177968f385729cf7d934c3ca82d4da8ad5dc025336b2ffdb0fbb7629fc0c400896304a5a71a001d030ee9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6667a1c-2233-4302-ba2b-3653662dc3c8.tmp

Filesize
5KB

MD5
cd59cb4d2114865492bc130381e55d6d

SHA1
3e93abf2db196a508ea8eda11638c1412cae019a

SHA256
d45f8a0b60eea594301b53213246317c41ccd215769ebd4a4d032d8e9f735b7d

SHA512
fa5f67ea65e3049614b16a6bde439315f2fb2de898f8122e55da40cc6c6039caf64e06a5220b9e8b87bf0ac1fe41b2f3f430224b206ac8abcf2eaf1e5151865f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c1a95ac233ca10d64e876bdaf7c0e1b9

SHA1
481ca46d317a5ed913a6535d655c0216dd2911aa

SHA256
896a59db701ddf92c38dc2dd0b281a8a4edc73c13ed9607a67d6fa11c820c575

SHA512
80e4161647b4a72792269ef6b3ffc9d18722b9e2bbc6422968356ab9f531316a53c803486185ec29b09564768517844825c81649cd8ac9ac3afa78fde29a438e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
b6962c460b67aab911f7086c43dc6a31

SHA1
b49a0f4202ef164c26d7ea0dd9c426c2502a4770

SHA256
6371fd3f7a1bc462c6d328d030d3d37011bc84449585bba53a5844eb8e6c482d

SHA512
f28ee0a181677313fa84a3e34c7bf650f8b20d07c884766cb597efd905764d879cde16fe865fc3b4bb0005efbfd55f7a63f67563b2873f771d45b43a26a6b794

Download Submit