31f10989295fcc28da734b4a4b7bdb47aa8c10e90d031528cf0cea2197ee3028

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

night-cheat.url
Size

117B
MD5

a2781ccbe8792bc98b7258ccc007090d
SHA1

86a4d3751a2a9e1f79922c5e3784a6ad401ff51f
SHA256

aaf4e0ca82bb3f28282be419d9c7e9272aa34e6f260f2b8a51491f93d4084808
SHA512

7a171d46e5a202f9dfcac2e470143c91ad1543c924e45a05a39940684f0b7ff648eb20e0b2626bea300f842c688e7305838cf613b6ab19757d743cc3bef94772

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027552071-446050021-1254071215-1000\{AACDBA39-F33F-4ECC-B598-CD54111AE867}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
4216	msedge.exe
4216	msedge.exe
1428	msedge.exe
1428	msedge.exe
4452	identity_helper.exe
4452	identity_helper.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 4216	800	rundll32.exe	81
PID 800 wrote to memory of 4216	800	rundll32.exe	81
PID 4216 wrote to memory of 2896	4216	msedge.exe	84
PID 4216 wrote to memory of 2896	4216	msedge.exe	84
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 3068	4216	msedge.exe	87
PID 4216 wrote to memory of 1584	4216	msedge.exe	88
PID 4216 wrote to memory of 1584	4216	msedge.exe	88
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90
PID 4216 wrote to memory of 2216	4216	msedge.exe	90

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\night-cheat.url
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/qBjBHMht
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa59f046f8,0x7ffa59f04708,0x7ffa59f04718
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3596 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2393639831007377876,1257455397811173470,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
8ff4dcb605b2b8d73695450737c9f566

SHA1
aa9cda57e9ba51068f3850f8628b51e15eb0629b

SHA256
3464252884e5f62a5f8e3962fc5699a3efec64c18ee43b12938b4c6b531b6e84

SHA512
a971ba24099cd6fc47c0720c64981ee517410e13e5920bf7c4cd5ab0aedfa80843a497133899e30300701c9773b8105ced65df99f6f64f4cf8a8e7a53f57850e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
537B

MD5
29ed9604d027f74e4a360f59ec21ca28

SHA1
e265ae8a5a441628bf42cdb591e696943fd14748

SHA256
06c6d87517a99e945c2c92328c67d747d4ffa5568236a95002180aec7fde9dac

SHA512
37fa05f7bf3471fc334bb37c672f362f39deed0013c98755c1670a005646c557b64272fc6285137f95fbd7b0559b1336457101cf60e59fe58602231dec528a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58e333ad3a9a2f10be0b2c3025c940bd

SHA1
b95bcd7ed098cc82002510f41b03bd49a271e76a

SHA256
5260b30cc804cb88573b19372eeaa1edcf8e04a8158d181f025273e58192b3ac

SHA512
ee4a3b9271839aedefd5e93bbb7c0c8f71cb8e7b7cf462731fcda41149db7cc59f9eafac0b0483a1024c644419ab4f27f6ccf4024f3baf8a5a25dee46e290491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d329f12f9db1409d529659f5bd9a2963

SHA1
bb30bc7b1485aa8606a70cce44abbca86b4e557a

SHA256
6c339c4e6f147916a38e8848e642de47a018d6456c155e32dbc7da6fa892b9af

SHA512
1abfc92fb62f6277dec41c53ba1a89deb7cd2d10bd54f22eda8dbee864ac9a2ef422e902b4047cb9a6d15a58a0f9d30bd515d9735ea7bf4a66f6b90025b87287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
25ac77f8c7c7b76b93c8346e41b89a95

SHA1
5a8f769162bab0a75b1014fb8b94f9bb1fb7970a

SHA256
8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b

SHA512
df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
853dab6fd9ea5b4862f409b6ea02b1ae

SHA1
50b4c479f7e0f3250d98471cd5eeb0a69341bfea

SHA256
90fd285a52a5f1b8274aad45312f921551e01ddff2b5869b3dc9143389fbbcf5

SHA512
5bb099e8ceda6cd8f7dff2571a35738ad16321ba78f98f977354bd5819aafddabf90b5a03e11774c479df824c1cc153f0288672f8e3b621015ec4578b0c1aa82

Download Submit