a1d303b353df28ed366a8fc944d93cacf25f328d63e2b95c30b188410a6894df

Resubmissions

12/01/2024, 05:35

240112-gactqsgcf6 7

12/01/2024, 05:30

240112-f7lx8sfdbm 7

12/01/2024, 05:25

240112-f4aqssfcej 7

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

huiziyuan.net.url
Size

125B
MD5

c5c2781c90eb13703b02246f554e4467
SHA1

e36784119e6555bf3c9bb8794fdeb1d2de2a2963
SHA256

e20696365d2876ba2aa7abdca6e0830c5e183121105a8b68cf412c4ec427ad77
SHA512

7fd1703843c9fd55ab08b681ad8e9ee8d6796eee54438ce7a8b16f042b11822032f9e2d69f658a043792f41436366542d0c08d31e802299385647abf862fe716

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3928	msedge.exe
3928	msedge.exe
3408	msedge.exe
3408	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe
3408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 3408	5224	rundll32.exe	17
PID 5224 wrote to memory of 3408	5224	rundll32.exe	17
PID 3408 wrote to memory of 4572	3408	msedge.exe	20
PID 3408 wrote to memory of 4572	3408	msedge.exe	20
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3728	3408	msedge.exe	26
PID 3408 wrote to memory of 3928	3408	msedge.exe	22
PID 3408 wrote to memory of 3928	3408	msedge.exe	22
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21
PID 3408 wrote to memory of 4300	3408	msedge.exe	21

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\huiziyuan.net.url
1⤵
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.huiziyuan.net/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffe8dad46f8,0x7ffe8dad4708,0x7ffe8dad4718
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3004 /prefetch:8
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,6262629645221282683,2632993928902608973,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
b44097363bfe64fe2f87187f416f5d2d

SHA1
485265a0f7a14804d9eabaf445b0d3a579803f88

SHA256
965d1f08f8b8f441e4ee0f2331d6339d40afd394e68d4f2af23775a2977c2871

SHA512
f1cfdf4620df4b09ed7153c712c38e5f477245ba1af618d7e170de25feda04fc2bb823d7ca7541d470872af27139351dee29141898d8044be6f94ab4e00a66fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
399B

MD5
722961dfdfb9a71cad8599e0a0d4f9db

SHA1
2866d807f075bd88991d05491d5227119f0d4612

SHA256
e6f1329b482e0eff36ba0e25ae84476e243a6c62f6f4c115f349462d9d368b73

SHA512
b411cfc4215b20b7889134c21f28a05363c78cab922679927ac602e89f28fa567fbbd3ac0e43b3670c1cde38ffcf61d83887a2a60a723404d3b2231b886891fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd4d116a7000b82ea098ee8bff1a9a0c

SHA1
6d8f7a7db237997fe5a2486ad16bf0d46c418d8e

SHA256
57cf7dcf464b976a33290f5cfd3976b750bdfbed9bc051e8f39fb669aacb5b4f

SHA512
3d29db59e4fc2299ee8b8abd91322876b3d96d212faad96f6bbfeaa6566a27946a711d60de8e44b247d7bdc41e871b36cddf291bd7b9ef4a5158c6de262ce360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ffc5e40a59e3a9025b5a8bfee2646ed6

SHA1
e7596c1848436ff4262bc3c33c68106613cca0ed

SHA256
009da0a2029d0089499cd4ca5d53ab7225d563aba4e54e0fd25c76b478adf4c0

SHA512
1edcfeae1d24fd2c50e6b14904e762663f58cd524aa1d38e09811b1e2678af70ff65904cf7e97dba212e6c51e53e42cb0a6b51345527ca5bbd191db00ee67009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ed371223200071f84b13f1585032a88

SHA1
36be3842516689774402c4644a1b46d488293a6b

SHA256
de0fc8a59f5e5b47d3a11d8770d60f2a54b2c1350f435f253d0cda5e724bd327

SHA512
f3dd60924f39b229aead8c463ad703a8185b5ec47deec17fbdf3101a926a053be5bd658165972ef48a1360f7414e6f9d152104a6867a8e235fe59b34f2aeaa64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e664066e3aa135f185ed1c194b9fa1f8

SHA1
358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5

SHA256
86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617

SHA512
58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
df2ffd020379fa87b56cbbf1d0133c2e

SHA1
957df88799e332adb5b32f761c7c1f511bfef04d

SHA256
41439a4288e6d7d176a70344bd8d172753601e53c7b04162012f402185b01f5b

SHA512
cef732855862bc89b2bc517646ea426954f35e77e89cdffcf307ca3f705dbf33fa4542f07fb9fd7b661ddb9fa95b6c5f9941daeddc96749cf162c1cc2cc48609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d2e0.TMP

Filesize
540B

MD5
9f2d323d47cd6d9d39ebc71dfb869e25

SHA1
01c60377a172554d9f1833245f8e5840a450b9ed

SHA256
3d511a1d81f3106ce50a3b2cd475f0887a40bc1d66b70f5aca7dfb321f58d283

SHA512
4d1f38affdcb8e5ca1fcf3e62a732f0b315e1acc6a42d2ecb89a18b86f088fb982c37bc545b2ac680bdde2837adb0bc1324981be61eaa24b9e5545e6d5654b3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9985cb0a7d9c1c02ef16e2a4747e7bed

SHA1
53aaeb889f4660f6aa64b163694aef59eadf71c0

SHA256
abb30b974a0da486eaf398dba901bac5d585c79e214d23bf08fea4aa835f0636

SHA512
2b72d9dd952a7d9435a05913e4b9e804e8bab3a1c9e708835fbd0c0fd1ee64d6fd1997ae340f5aaf42ca76c14327353d4024a65f1508f1c76ba449120a0a2e36

Download Submit