Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    2339s
  • max time network
    2343s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/08/2024, 18:11

General

  • Target

    https://drive.google.com/file/d/1QyX01uKFpgYW11r_odm4LiOwr0Haqr__/view

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1QyX01uKFpgYW11r_odm4LiOwr0Haqr__/view
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe80f946f8,0x7ffe80f94708,0x7ffe80f94718
      2⤵
        PID:4780
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        2⤵
          PID:1960
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4252
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
          2⤵
            PID:4836
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
            2⤵
              PID:3568
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
              2⤵
                PID:4716
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
                2⤵
                  PID:2376
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
                  2⤵
                    PID:1616
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:668
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
                    2⤵
                      PID:4408
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
                      2⤵
                        PID:2520
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
                        2⤵
                          PID:2976
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                          2⤵
                            PID:3184
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
                            2⤵
                              PID:5168
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5340 /prefetch:8
                              2⤵
                                PID:4668
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                                2⤵
                                  PID:5256
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13835509452486656227,8429265871005605297,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6396 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5696
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2676
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3444

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    9b008261dda31857d68792b46af6dd6d

                                    SHA1

                                    e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

                                    SHA256

                                    9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

                                    SHA512

                                    78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    0446fcdd21b016db1f468971fb82a488

                                    SHA1

                                    726b91562bb75f80981f381e3c69d7d832c87c9d

                                    SHA256

                                    62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

                                    SHA512

                                    1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82cf1cdb-7def-420f-bd80-af5f7e16b9ac.tmp

                                    Filesize

                                    4KB

                                    MD5

                                    329f26061465f43726c46748d0adfda4

                                    SHA1

                                    c789825b7b41ba2da8334e6d21ad1301374f3d47

                                    SHA256

                                    166bd7990b0e0cda554dfda38d530660cc9623e3154aeaf03925cea97379e4c4

                                    SHA512

                                    eec37e13195be0e9fd86fe3f7417c33eb9248ba642f4b15ea8a82b38586eb78483a58900f14201f50dbe39d903ba963d77e7c36502c284cb6584f212dddd07ef

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    408B

                                    MD5

                                    a03d8c3ac66cff288b873bbd40eff5e3

                                    SHA1

                                    7c0165de33b2abfec8d3c2330ee7a97464d2d9a6

                                    SHA256

                                    68317ad092ac4403c545b848c6d3445a4a8aa7f6e5060bfde4daaa0096e6f13d

                                    SHA512

                                    77dcc299f0be24a609101447be3ab8e0fbba686baaa59d56ed270a801f99585752166c2d18d95de17a0379db2b0ad29281d2604796f6602171354bcd7f077c98

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    b0f56ff649f64229c8217c62cae95ca2

                                    SHA1

                                    d71ee82090cef36809a963f0c4ac9681cc21520a

                                    SHA256

                                    1e53749f4f5161e6d935d17c763c637e7a5f837d57fec1729a7aed86db2a3c2d

                                    SHA512

                                    e4f06d8d7b41a2dce00e9eef20b4a99d306d526bb0f8ea640fcff220eaf7d231ad6afdbc52c94bf0bc8d0dd23166f8e6aaed4517c219e3583800fd4d3d31e3ea

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    206d979f65883d1a7a3fce443b0688b0

                                    SHA1

                                    0eaa0a88d7777776d646d997a77ae343849133bc

                                    SHA256

                                    c202cab81b0094bfbcbc157ccc0f1aa8d1b68e613e4583b496ce359258093001

                                    SHA512

                                    6432edc34f5202e49e2899379a002a7c10d3b637c02d775b962c823153835f9a1ef54656bb8e91fcb4b0f63966f27f1441bf6facb036567b538457892e378d9f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    fe7b8fd49e7da17e5359547c28437053

                                    SHA1

                                    2c780100ba06f9ec81079b36ab1d9604142f9bc8

                                    SHA256

                                    a0aa25579d8b0d078a039d4927be313c503e40012eadb4062a6b2e84b486c29e

                                    SHA512

                                    21e84682702b153e9d888f0e6501aed0e4cc3e266696257849742e0913f4c715b945212a157db6b8f3021224b002e2b5fb31d6926bfbbc38de417cd3e86d6d9c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    111B

                                    MD5

                                    807419ca9a4734feaf8d8563a003b048

                                    SHA1

                                    a723c7d60a65886ffa068711f1e900ccc85922a6

                                    SHA256

                                    aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                    SHA512

                                    f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    c892881c46950fc24429144cd8e07abe

                                    SHA1

                                    9b04ba8cbf8fe269428bb2fb0fd01db208e3121c

                                    SHA256

                                    d82d51ee3254e5b703c4ce49c9a4baa49800519ce7c903cfef5af5ecee3a1994

                                    SHA512

                                    d0f6fc76c19fa068018a1dd7b558b53163685bb6357ec33bfe6510d1f150801f18a4ddad6859638e5c298e46e1a3476e5f787d1cdf194cfacc0e443fcf4652c7

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    d24156d39addbdaee669726c90dba599

                                    SHA1

                                    2df988b0032416e0aaef9ef1551ae0a81d3f9fc1

                                    SHA256

                                    6fbbbce8afd9649bd779f3b83a7fb347b6461a28ca8a4934e8f35d30bdaf8543

                                    SHA512

                                    354a10dee09a7e5b26ee7372d88944af1ef9618354691e5e1ece67ed5d41a4de92ac805e32d07576949219dbe54f9b1db3f1dff4ebf260cbe21713f631fbd845

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    804e675cacbba7f3e6c9626e8a4dad28

                                    SHA1

                                    54cff0458bbfa3467d7957a531846fcc875c0faf

                                    SHA256

                                    611ea8a69f342802361f1c8b6dd85174066afc2873823ffea776f2c9ea5949a3

                                    SHA512

                                    129076d26ec1d5b0cd0c83eee19c3db993d5d58875014a22472db4d7045b390f9f0621c742d93e5196e504697cac04f53a934e0371cf39a22f169dd9168ed655

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    4KB

                                    MD5

                                    b0284fe075813945597010419dfa2673

                                    SHA1

                                    ebfe3630c09cd1dcaa956557cbd1dcd12f9b4c7d

                                    SHA256

                                    e2f874f2c68cc5a13ff7fab533dea206707402edd8e4def168c1a8e22edcd9cf

                                    SHA512

                                    f5cfaca7a12355c80e116cba5e27e20367d1d37cc482af25fb59bc4488b081811290dce3a9671875c50a0c9d88d627e0ecdf727011de70ffbf2936e5e9992254

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    c3b3db3ae37ff100b87057dc681d1865

                                    SHA1

                                    e07844161a6c2d54b7f65720a169b895f0f16304

                                    SHA256

                                    75c9cc742a6a16a30431a58d943f22a19512d3cae2344f8d5d50a8a3f54a29a3

                                    SHA512

                                    a32cc6e46f9f319f5922c5789bec8e6fe089d066f52f1ee719f665815fb024546037b2a6e70dbec1b28f4398c83bc98a550c9620d135e99228ce08ccb65f4174

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    e19859a1163f99884eb21f3d1770f64b

                                    SHA1

                                    285780746bc9fbe0c511a2fd42081ad4c684c814

                                    SHA256

                                    ae8510269b647bbdc02a4d8a0db6617d607eca7109a86e150270f6a8a72f92ca

                                    SHA512

                                    d9f7bb2739b70c84d3952aa123ccc47459b1857cf9e8a06b1a55de37b279e1602fb4d7a1716dfd322fc173489823192f365c3d26fd3899aa004e73a638893f14

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    95a30e2372246752e70e4576c6bd7f84

                                    SHA1

                                    2ad4ac107ef29241601aa76d3e2d52492ae558a5

                                    SHA256

                                    ffd96e4c647e8bd5a023fd3ff3f3e48f6fd4632cc6fc4405fd9755774409f774

                                    SHA512

                                    cc32ac3d96d2018cce26752e66d0a81c3b66b802e477bdbfced98d4c6c5027011ee45ffebd5b3e85fe5463a0bf3b96626899b13f812845ca04bc7344f93e8155

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    21477777a91c8166bd9fc46c381f1ad9

                                    SHA1

                                    49c414a43c9eeff7ad2ecbb1d580f0b06966a8be

                                    SHA256

                                    34436220854ca7bd1b49fb5e600dbae685d22bf19419bdd14e13828f6e8582d9

                                    SHA512

                                    b687fba7fda933b713715e534831cbf4d2a1c064fc27b41ed83d5770ffc3762e3abd15b636a4e9aa1bc442a90ca4ca85512f3354d47bc7711bdc4f5dc655be04

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    12KB

                                    MD5

                                    ff3c30be28ee6477dcd31e5420b29cd8

                                    SHA1

                                    82d9f4af06611533979c1a79358e29580a8f4092

                                    SHA256

                                    bc17cca528523f29b999f5a3ab1b177a52a3db8c50b9e058769c2b0975d16bd3

                                    SHA512

                                    016b1a8655c42f40d5320d49bb4701e4368a162d86ff9052497d999dea43a7f0ca01926e89a707090b20661f122ed8adc090778bd48ea3da425e93e0ed078a30

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    1865e0d59763bb66f177ddf9c304006c

                                    SHA1

                                    0595a972dce286fb777ddf1d0b2621dcdd250b5d

                                    SHA256

                                    3ab9f7c0204b4e3fc2d5b17f2e8b5bedfbb08d444a0f8fdd71f77eed5a938d4f

                                    SHA512

                                    88302af7e05f06d19d24b4f07d60c546c3ae5bb9c3af2c96da54c4bd5c85bc0d50486411b3d702c42e98629fb3aa0d4849bbd26c7e68bd505f469de35073c42f