Analysis

  • max time kernel
    720s
  • max time network
    725s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-08-2024 17:40

General

  • Target

    https://clicks.aweber.com/y/ct/?l=18XlE&m=ifkjkEkoo9.0_fP&b=it0xZ48rsSw.ezW5vmtIFg

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://clicks.aweber.com/y/ct/?l=18XlE&m=ifkjkEkoo9.0_fP&b=it0xZ48rsSw.ezW5vmtIFg
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeebe946f8,0x7ffeebe94708,0x7ffeebe94718
      2⤵
        PID:1516
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        2⤵
          PID:3780
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4580
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
          2⤵
            PID:4968
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
            2⤵
              PID:2688
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:3048
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
                2⤵
                  PID:4640
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3160
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
                  2⤵
                    PID:2120
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
                    2⤵
                      PID:1416
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
                      2⤵
                        PID:3416
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
                        2⤵
                          PID:2500
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
                          2⤵
                            PID:3716
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
                            2⤵
                              PID:2552
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
                              2⤵
                                PID:768
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
                                2⤵
                                  PID:4396
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
                                  2⤵
                                    PID:3968
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1058400243004711095,11311843202998180486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2948
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3416
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:1840

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      111c361619c017b5d09a13a56938bd54

                                      SHA1

                                      e02b363a8ceb95751623f25025a9299a2c931e07

                                      SHA256

                                      d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

                                      SHA512

                                      fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      983cbc1f706a155d63496ebc4d66515e

                                      SHA1

                                      223d0071718b80cad9239e58c5e8e64df6e2a2fe

                                      SHA256

                                      cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

                                      SHA512

                                      d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      432B

                                      MD5

                                      a08bfeacdaca269b5a0774567ac2ccb2

                                      SHA1

                                      d199a405f26ff60c264bc4894e529e793d1cbb86

                                      SHA256

                                      f1782698d999e51628d4859a13193b283538f794edb109cc3da54ab67e45edc4

                                      SHA512

                                      e66a9f400c922aa57808745284bfaaf079895159088d47c2130c0bdf64e4025d34b6c6999e6a0ba43846af6f0c512c577aff6ae3e61fae3e0cc6d53fe3008823

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      216B

                                      MD5

                                      155ee1ae0400c559bc5c7920a7c728d1

                                      SHA1

                                      7a4509598eb4169598ca66b49ace7f225a0e6003

                                      SHA256

                                      a52a80ce08ac52d117f9ae9df7a987297df26f932feb81f58262bba86ad44e65

                                      SHA512

                                      eaade80c89bfac17997d55d2024d55cd25f127de31aea16d7a9d0dcf711b731accf915f2018c372d27d299d92c1013a111f3e670ebe61049ef86a2e0d9545334

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      111B

                                      MD5

                                      807419ca9a4734feaf8d8563a003b048

                                      SHA1

                                      a723c7d60a65886ffa068711f1e900ccc85922a6

                                      SHA256

                                      aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                      SHA512

                                      f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      6635c4e5f0f0d5679c3767c185081806

                                      SHA1

                                      a424a4996551bbc102614c67eaa3c6c3d23b9d5e

                                      SHA256

                                      fb605fa325c7cc2cbcf71906b73440952fc01e12ce05f32194558bbf35b2eda0

                                      SHA512

                                      82563eb9b68b2bb0854690e27f7f3947b2165d6efd126b373ea9c8d3f890ccc822d6c5b0ca4743230f2dd01c069eae70b01c722252ce47599703e1686752df64

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      f03bb83cc57796b352f59fca74e3a7ab

                                      SHA1

                                      8c6e4d85a616951c0eba5d6d7c432588d5ca1a31

                                      SHA256

                                      9b6fd378d94ab28e13779a57ad89dbe40c4fd699f861d6d3d70e103acc3f7402

                                      SHA512

                                      c7778c81fac52a30e9e980b0452e7dc7bf9392ede791304b7d4e0ea10995564549aa4536b796d5918694919c262754fe80679e4d68a317ca209a2d597cef949a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      2312c27077c71115561a99af9b083855

                                      SHA1

                                      4e1c1ca195257458815e8fbc2141f6eae6d7e262

                                      SHA256

                                      2f545c384ab41f2c98f2aab0548f069b71e9a944338f293a012aab2e706f9a5e

                                      SHA512

                                      bfdbb20e5b5547fdad8fe7c3ca7c02726b5d16e6bfaa7c421af8e90b68eeaef1d5ddfd8e50012a9e963308a523044d75b7c5a7953ab074b84a9668cbbf933cf5

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      f0164e89152995206ee3a946e9ec7de2

                                      SHA1

                                      1151efc78b5202d9b012e73aac6b59e1bf9d18de

                                      SHA256

                                      bba3c789902ffab9393a25e5ca96c6d0b53b4181a433d17cd3acd52f13d7cc34

                                      SHA512

                                      3b3fdaaf4da7af4ad5737ef892b6138ced033b173dc6c8aeda9d6894a178e623fec26f2fb414a966748b270017447450f1a79266a1f8117d33a14ee67e8bb8af

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      66a58acc3191fa4874e3f4dcae233e1d

                                      SHA1

                                      3eb8d6993a9c233831ae9f44d8027c05a32e6fa6

                                      SHA256

                                      1ecb6f5910ce034ed689e77783ec091632ca10ee4243633b05f1f492d0efa732

                                      SHA512

                                      1dca90d8ad10f222d17ed2b57cd64b440e3b5af3047925c848e0f914fba0429798b440e6e08c007a97924c5b541d31bbbcf1dab0720b86dbf547ba35017825cb

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      2961739474832db11a44114addc9b77c

                                      SHA1

                                      68e532ee8862783c1de7d78429b30f5e4c870ff0

                                      SHA256

                                      f9a4288e93421bdcf6cf5e6a9b52b568da20d232a12f9f2feae01f29bfa367eb

                                      SHA512

                                      84eabe67691018dd1ed4e10f4126e45d9364b4984ced4b1964a78a4a92c4a828e187c644c549d0afb383bbb5e431f5625f467576ad3cd766c0e84f9385d05204

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      704B

                                      MD5

                                      f7672c165ddcb19e5c9f19fa26f3aabe

                                      SHA1

                                      383849cb1d761ca9ece1d7c85bec3feb603bde8f

                                      SHA256

                                      c34707574e013051edb7d855688350cc2eebb9bad37a39d119fcdd85a0ff0c83

                                      SHA512

                                      67ce04460f1c8a54d979c8461191e4b9258c4d68ee7be55b48ab5bcea5166401b0effde265a454c03533b645392616e9072b785af690241e7dd22a0761c3f6c1

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      872B

                                      MD5

                                      430085d5ed5b79c83a255889559e3d0f

                                      SHA1

                                      d43db17b7853642bff28beb37d800ee830e9b1fe

                                      SHA256

                                      3f3f0c2852ef621151ace9f5aae11a620191d5407f4453b161ac31f79f3a24be

                                      SHA512

                                      2780ac716bae3e3e3525bdff8d59c34656488649b2fdb88ed2c5d98fb6cdee90ff25d6d7608f25b496517971b5b9c8f80f6a97c5db3eedab574d7d945504812c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      704B

                                      MD5

                                      eb91c2ab9d2ba74f6f4ebed6a9c6ffad

                                      SHA1

                                      16d51b4a022d80e1bc28c7b8ad3c84de0beaf75e

                                      SHA256

                                      98dcd857a4245cde05f3666c70ac82929b5d6e42be97bd48273f3ee927e69a2c

                                      SHA512

                                      e4b8ab7e240d27dbf3eda1e4c4b1794b3e5f52236a5a75c588988b8322c211aa60e8a070447d2a15c1b25cae42811fbcb3590474b15221b9caf827421542b090

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5823fe.TMP

                                      Filesize

                                      537B

                                      MD5

                                      839dc710490f1b1b86b902c10231eb00

                                      SHA1

                                      18e44354888a415a39cafa3ab3eaa0d1101752e3

                                      SHA256

                                      05b9fcf9b7c69b2eb3567dc884a78e5aa52c3c66db593339e06bbe26cbca4961

                                      SHA512

                                      83481f5a62eab91f9a82af90fffbb831409c5294d0e9e020fb7e733c179bc556f996897e2e95bc0d3923eca06fc714cc4374f347e1401a3355750220589b2927

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      029ad56fa19f481181e15ec89e4b65d1

                                      SHA1

                                      5e265b76c6b5cb9d56123dbb7c122628ad443038

                                      SHA256

                                      010d22ae97b2d9ee346c7aa93ae9764a58fc0c99bcf2b953628531633acbfb94

                                      SHA512

                                      13c52790a417bda0554509b5b65abcf5a367c71340acb5db0c0db37c5c4d20d58a15735593dd801a72d6c6d3aac2021efa2b23fc3097b3e491ad576d5376a4d1