hxxp://kansas-houses[.]com

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://kansas-houses.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4256	msedge.exe
4256	msedge.exe
1140	msedge.exe
1140	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1276	1140	msedge.exe	84
PID 1140 wrote to memory of 1276	1140	msedge.exe	84
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 2924	1140	msedge.exe	85
PID 1140 wrote to memory of 4256	1140	msedge.exe	86
PID 1140 wrote to memory of 4256	1140	msedge.exe	86
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87
PID 1140 wrote to memory of 2864	1140	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://kansas-houses.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc071346f8,0x7ffc07134708,0x7ffc07134718
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,12770801800991191705,9891193586599690076,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
d0b831890e9704c6dd1eae4cef2a969b

SHA1
08263295c98b7e5a6b204a0059ae8d5aac690023

SHA256
c86760fd124db8c9209fa828470e0ef8e015b1fab7476d9d286e2731e944216c

SHA512
444c346c50c349734ee0fd87d329ce6847c69635053131beeb4ce872a5b153ef3393fd775b3c5977158d8ee09d4f6c783fcd7e9494a6a0c0f089a2d5ee841dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
85deecae3b26b7eff4407f8ccbd1503b

SHA1
46326b7fc82de708fd01da715f3ca7253943b31f

SHA256
8d825ebe02d864d39d328c441b928e3fe9bf1a66c08258980f09811f8ad36eac

SHA512
6b2dec632a31e439ba3b99de101b749d55b3f8b8f06773be88c6411fd9db0442aeb74fa3a07757375f65c4ce1147c946402f2556a777aa7a4ff7a855f9f153fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
953369eeab313098333ff4fe2a1d73d5

SHA1
734551603c3e072ff13269c4b9dd94572a9adc8f

SHA256
6853af9ffe32bc1986925385cf89c91365dab150698b15611275fd3e5d3d3bb1

SHA512
60f17ecd05d4dd9a092992caaedf058fbd28ff3db86b4f3db64dea38c57e878525154d9c521c14840f8797c524f898c583cedc9cda4ee481aa91c29a048e6ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51a287cf374b2aa69bcea5c66d2c3aa4

SHA1
bc184ae4f90e4c384eeb10859835b022fb55a72e

SHA256
7b1c671d2aaacba2d67742db64c65dc13e761ec07c621c7c29cc96037b39380d

SHA512
914e303985757c49b5950facdfe09b9763f870931e03b2648e7bc8a67fa4afae3488777cedf91311e321db99b4014a6ed3fbda7ecfff1424726cd1707834362a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ab8b5697ee6890d3b6b09761472f0f37

SHA1
aa88bcc3e9ffa78c29539689c9a26f226ae65bb4

SHA256
4283f4bdf22cb08744ac98aed8ead76c9a73f28ef038b8840d4f01f6403e906c

SHA512
70d9bd2907017550b851079947f516067530d9e137f52c27e8cffaf0ecb4adf3fec28ab812472f0a7b15702014eb75819f28629559eee50e34dd78a093df295e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fabb.TMP

Filesize
1KB

MD5
15eba2da95d519ba2d915797fa2f47c9

SHA1
56551217db926b637d052c53368aceeb173281a5

SHA256
24df280aa8f9bea0172b02c1c724242b6a9d5c43c19eb3c1625225d55472a98a

SHA512
24edbe47ccbfdc6fdf694f6b588597268de932e8c386fbe93f8f6caee92bc7b97209eaaa354dea30c7ea53868d77538509f7169e203766a3af5dc8957f88fb3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c9443729cf43899d011a6fe95a53971f

SHA1
7862c4739a7accc76b6b68987f324bdce39111f5

SHA256
bd29cc8fc14ed69d8fe80cf28c4c508aec9a4bbc31e934b00486d830ff68788f

SHA512
5ca1a49055f751796b390796ac075a18cbe623882c85dfa0e8a5ea67ca09461058cb448fcc402b8c2cd69f3997821573dab27d2facef3eea123a1d4c8c5b4e1a

Download Submit