hxxps://mega[.]nz/file/vo1kAZzQ#RvkHJ8LY-8Qvzc8eEB5V_0BrjDg7SKpK8StNIEDQ1OU

Resubmissions

05-05-2024 21:29

240505-1b69hsed8z 1

05-05-2024 21:18

240505-z5mxaseb71 10

Analysis

max time kernel
720s
max time network
770s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/vo1kAZzQ#RvkHJ8LY-8Qvzc8eEB5V_0BrjDg7SKpK8StNIEDQ1OU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
1828	msedge.exe
1828	msedge.exe
6028	identity_helper.exe
6028	identity_helper.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 3416	1828	msedge.exe	83
PID 1828 wrote to memory of 3416	1828	msedge.exe	83
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 4356	1828	msedge.exe	84
PID 1828 wrote to memory of 5024	1828	msedge.exe	85
PID 1828 wrote to memory of 5024	1828	msedge.exe	85
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86
PID 1828 wrote to memory of 4680	1828	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/vo1kAZzQ#RvkHJ8LY-8Qvzc8eEB5V_0BrjDg7SKpK8StNIEDQ1OU
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffabfa46f8,0x7fffabfa4708,0x7fffabfa4718
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1340618673786674934,11394762131288299139,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ec52deb744525a3d458df9f700d00510

SHA1
d97860176956021783ffcb2a472e085d695609dd

SHA256
4244e7bb949f767dcc7d8ab931e9a11197ea03a18bf3464e2142925f4e24839b

SHA512
c552ff37fc528566d42eec629fe5faed954440225e8a11ee41621e74fd72e7feccbb0b9bdd3863cfb5d6438f53998e84c536aa77f0e24a1efe6f76d370f42977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61a53c2ca62239cb431055579e7196fa

SHA1
27e8f023a3097e85194acb08d8ea07b7d1cb6ede

SHA256
1ae047a59e5dcf2f653d12cf70bf2390666e5b17e8752a2bf54d7f8e67656c37

SHA512
a86e0eec7a5b5d96de1ae930bdb3e229b6a915084c80acf5122bae863c1c5d32dcff5d29277f7db92e2f0e05223ea279419162def73fce90e46282ce5f3dbaa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9768284a2b778ff330519329361b79c1

SHA1
412cc9e039d8c0fc7e1ea21788ee7d81fa91ebf7

SHA256
d9acb6b435bd3c21ccbca71358c810cc3c1d8a30daa0f1c68780d2c0eb354622

SHA512
83abb799f751382d7a0345804cea660bb96e1b652b508ca778a4442e94bee2989635640b2d5749fa0c15d851a49cda34b610f982c9588f0cf0afe704358d388f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0dc17e5e0e0a6d88acccf1b575a23181

SHA1
2897715f9ed42e4a5217e1504ae003851fe11503

SHA256
9b3bcddbc6b5db656d161e1d963629d099f9b6602bcf16f58daee097547a5206

SHA512
ad9020d1a1f1a430da3e59a061642de9e680f9138f842a09e8a89e9afd84d59fbc377ee53ac5087d1625601bd05a66c5d7241619817d7fbeaa244d4b06b1c390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57929b.TMP

Filesize
48B

MD5
98bba7d8d8c7eac47cd90379a21cb9f1

SHA1
88f2e33dd0e998f3450ebb3e99ad61e80d0e50e4

SHA256
190bb39b35bbec98d50700c9f54fd88fe7ba6a1ceeabde8f6718f0ce20e7c3dd

SHA512
f7153ba2940fe2093f8be837649695451e3180ffca763310debd3782ba0b9e38182801034202d2b09c185a23f2a2df8f309b4e4c39a16b4ec9fef4eda02ae7a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f767a030a83ce35e16161e5d6a04f3a6

SHA1
eb89d93e9c2444b39e4e22f87882c9faa488c794

SHA256
7cd622f4df273e72cbfcf2749d3c2f9ab096c0565f4fdc7306b60102412bd58a

SHA512
4c6ebcd25a3cc6a9834cd275e8d4d4b65653af1e5bd1332846afe9f862e93c5c1c6af3d9bc4700d682f4199cbb56c2fc606211c0730f04e5a0b469ee2a3abc89

Download Submit