hxxps://ja[.]cat/MatriculaCFGS_23-24

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2023, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ja.cat/MatriculaCFGS_23-24

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
3740	msedge.exe
3740	msedge.exe
2888	identity_helper.exe
2888	identity_helper.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 3440	3740	msedge.exe	85
PID 3740 wrote to memory of 3440	3740	msedge.exe	85
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 3292	3740	msedge.exe	89
PID 3740 wrote to memory of 740	3740	msedge.exe	87
PID 3740 wrote to memory of 740	3740	msedge.exe	87
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88
PID 3740 wrote to memory of 5088	3740	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ja.cat/MatriculaCFGS_23-24
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff936a646f8,0x7ff936a64708,0x7ff936a64718
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,13490392888699976036,13236829357920243664,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5524 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
93e195ade489072ce5b6334a827d5ba0

SHA1
35847e04ee34650db9f2b282d93cb4a84b3e781a

SHA256
03937261db3193ae65be4b568f545b756dbd7535d1b471f2490422312c8b54de

SHA512
35888e123f2af44b4141275215aea3d6052ee1ad7cbd885985d24100256a9ae5209c1f52d9e12886190d7b4e9511866ad5653170a783b402d3836d23e8727baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
93e041e49930a2d67cd8c527985fa3a6

SHA1
ecf41cdd3c1cf15a4fa5e9b71b73ae740da11782

SHA256
cc831e75293863ea90456952d0f7724b855d8d66872efb3a72e5d685c52de68d

SHA512
6d730da707cbb7dad7283c182d8ba981499e0e13a937185a2a5c0d1eb1a1d3493127e8c191e27f748bee0cd1356fcad2718a63f63d9be7322d3a7646d6dd1259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3d3c8f9975bd6e231a5cc908e29a10ae

SHA1
21c22a1089f2b70ddd227e4b03468bf7db895e58

SHA256
911cdbeaf9930a960be58b9af7fa4fad680ef98b2cc47010a921834f6068e0c4

SHA512
ceda23df46c7d28436b6d2fce392922e0b8cd3c46519a8b9853d06f51f8df1e9e50cf1a675ec5de85e69d43439ce8901cb5568d0e7bf8ad6a6ab244948649bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c4ffae2a9f0cab41815a81b5f1b01f7

SHA1
4135b655d373df2f0b8247f8147b2d6840881b81

SHA256
a5b20ecabcc1f28d2f71314f153e618785b9dcbf8690098cff9f77848922b1ad

SHA512
2d510d94a4fa5d92a87fe1fea4a3edbbcf647a0a3636458fdc8f4bdf509ac2964425214de32ec66ebb8e111ece97f56e06978eed011342e884bd0c191f8e6c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6eac6081153e23bd7909711b0d1cc7b7

SHA1
872d55425aac58eed5c009f4c1daaff5104efa71

SHA256
5a9a0cbd047cb0b38f355483d17e23e4effaf422bd5d68ef50aad606003e139e

SHA512
308743cc823ee4e5975c666627d41f10728c4c1fc6978a516e622b35cb773033c14f6979b4fb399904ee331c491d915be4edbdf534d1987a2ff3955da84fd284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
201B

MD5
47a2fa7aa4247b0f6ee5868026484dfd

SHA1
d3d2e3e677a09326adc9561866d3af97e228f261

SHA256
97306159eb806700b29699dd487688f83fb1e4f36fdcda8c8b113ee7ec55d57a

SHA512
262c52f579aac2b2b2ef241cdae2bf41bf6d827b12435a592d67129ea4180547fde3ad7058df94bd6c57faa6bfe2eed35e762d4428030d41593f99ee6adcc50a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593cff.TMP

Filesize
201B

MD5
744539afefc366339699726a3725008d

SHA1
0e83faf4baea8dfaf56f52caa0b4215d6eda8e44

SHA256
5b662e9d023c7c10f7e64e140704ba22a1115a3acce04b845f15bc535c7ade0c

SHA512
7934c05dcd6e755c9a99fd4afd05917ecf33ab87d84ec1c4dc888a54217b3ad779f7c900b3980f2c78071698dcb9a7d10e99b06c1def72a08ca73a34a9d5519b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
696cbe75fb271e11c788a24fe348343d

SHA1
2e34633987fdce1d38c21c21fa36f08ab78f4330

SHA256
b836d1d4c39055a28ff965e7cc3b9e952f48855e419624eb086c49e6e4125ce8

SHA512
6062cb88e46a30af8d4b65aa69156e0185b04a95ee1b4f373bc9f411eb3641d70c01d01cbfcf06bc53a0e5b67c3ba39bc59b0599b90c84d94404480a2b882d27

Download Submit