hxxp://admin[.]sigmamovil[.]com/click?e156293/HYWlvMjc1NDk5LGFpbzI3NTQ5OSxodHRwczovL2FpbzIuc2lnbWFtb3ZpbC5jb20vYXBpL3RyYWNrX21haWxzL2NsaWNr/qP2VtYWlsPWdlamltZW5lJTQwc2F0LmdvYi5ndCZpZENvbnRhY3Q9NjZkNjI3MDg0ZjlmMWM0NTBiMDdiMTI1JmlkTWFpbD0yNzU0OTkmdXJsPWh0dHBzJTNBJTJGJTJGZm9ybXMub2ZmaWNlLmNvbSUyRlBhZ2VzJTJGU2hhcmVGb3JtUGFnZS5hc3B4JTNGaWQlM0RSSEhlbTZSRHBrcVA1eG5FaVRYM3pNQlNGV0FtZ1dWRXBrRlRlSm5xTkdsVVFsZE9SelJST0ZkWFNVUlJTakJPUkZFek5WSlNSVWREU3k0dSUyNnNoYXJldG9rZW4lM0RibU1IeFdjZVNHWWRiY0VXVjdpaQ/scg71a11cbe

Analysis

max time kernel
61s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
11-09-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://admin.sigmamovil.com/click?e156293/HYWlvMjc1NDk5LGFpbzI3NTQ5OSxodHRwczovL2FpbzIuc2lnbWFtb3ZpbC5jb20vYXBpL3RyYWNrX21haWxzL2NsaWNr/qP2VtYWlsPWdlamltZW5lJTQwc2F0LmdvYi5ndCZpZENvbnRhY3Q9NjZkNjI3MDg0ZjlmMWM0NTBiMDdiMTI1JmlkTWFpbD0yNzU0OTkmdXJsPWh0dHBzJTNBJTJGJTJGZm9ybXMub2ZmaWNlLmNvbSUyRlBhZ2VzJTJGU2hhcmVGb3JtUGFnZS5hc3B4JTNGaWQlM0RSSEhlbTZSRHBrcVA1eG5FaVRYM3pNQlNGV0FtZ1dWRXBrRlRlSm5xTkdsVVFsZE9SelJST0ZkWFNVUlJTakJPUkZFek5WSlNSVWREU3k0dSUyNnNoYXJldG9rZW4lM0RibU1IeFdjZVNHWWRiY0VXVjdpaQ/scg71a11cbe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe
3788	msedge.exe
3788	msedge.exe
3104	identity_helper.exe
3104	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 1520	3788	msedge.exe	83
PID 3788 wrote to memory of 1520	3788	msedge.exe	83
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 4028	3788	msedge.exe	84
PID 3788 wrote to memory of 2000	3788	msedge.exe	85
PID 3788 wrote to memory of 2000	3788	msedge.exe	85
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86
PID 3788 wrote to memory of 2652	3788	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://admin.sigmamovil.com/click?e156293/HYWlvMjc1NDk5LGFpbzI3NTQ5OSxodHRwczovL2FpbzIuc2lnbWFtb3ZpbC5jb20vYXBpL3RyYWNrX21haWxzL2NsaWNr/qP2VtYWlsPWdlamltZW5lJTQwc2F0LmdvYi5ndCZpZENvbnRhY3Q9NjZkNjI3MDg0ZjlmMWM0NTBiMDdiMTI1JmlkTWFpbD0yNzU0OTkmdXJsPWh0dHBzJTNBJTJGJTJGZm9ybXMub2ZmaWNlLmNvbSUyRlBhZ2VzJTJGU2hhcmVGb3JtUGFnZS5hc3B4JTNGaWQlM0RSSEhlbTZSRHBrcVA1eG5FaVRYM3pNQlNGV0FtZ1dWRXBrRlRlSm5xTkdsVVFsZE9SelJST0ZkWFNVUlJTakJPUkZFek5WSlNSVWREU3k0dSUyNnNoYXJldG9rZW4lM0RibU1IeFdjZVNHWWRiY0VXVjdpaQ/scg71a11cbe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca36a46f8,0x7ffca36a4708,0x7ffca36a4718
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2400 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,575253047227368371,4180047192958759733,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
06c599a722b824001e87370d3974149e

SHA1
9321afdeea88aed4c65af595ed153be7b67a133f

SHA256
c4dc96ea3ec6c71a882917400d37bf31949b5fbe6ab2774210b5985e456782fe

SHA512
e63136179bde608ae9f758c0eb5afe3a6f0ff88c6f4c11d5e2d00ce5dfecbb7dd8df81a8a440ee86dda198846fb68cd002c0b5b0268830b722c171f3100c9012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8d83a26b814459c6ec7ae59ecf3c6a59

SHA1
6a0ae5e005ba1ac8d08663d0de80d569d521a6f0

SHA256
92441fac3692368b73d63306de304af16e50a10d42801b3b2a49e3e7409c8883

SHA512
7d668f12464a69418656bc88ecb988004745b90544a4744e2bba72b4db8f371d950d8fef2ce8f5e490ada3ed2d97115f1d7ae51e4bf204d73a6d3e39d999c64a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
87f58599b08645de8915d653dce3c32e

SHA1
f5dc7707023ac51c0d42f556c778304020d8faf5

SHA256
640fc1b31fc77b28131a8ea36132df8c86a35668dee5c8205ff3824e00c17dae

SHA512
6b387d527d20f97d4f612badbb362e971df3775efca7360bb19a17076ed6ce8e74373337ab8859fbd848e9b036729141de9a891073d39b6d5466ac1fbc747a93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ce0d5ad7-e0c9-4205-849d-5b54e1bd7e88.tmp

Filesize
5KB

MD5
1b2a19476f9714f918d0157b1a93236c

SHA1
9e3cbc73f7231196e8ae63db07cbd3dac8526752

SHA256
0b4d44aee648cd2293fd60040218ed939bfa631fdbaefe55ff257f50e42bedd7

SHA512
dba245ad9a3a8ec3a9d1004498da4ba8a590b89a5992a8f2e90d9a6ea771a159110e3058f2cb9626c5dc31d28e61a24a00c61f9e3884ce16b861010734e564f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
4d7413f664303ad748c7cc74bc7356df

SHA1
b7a6efb390408da35d42188b7ad1768492067738

SHA256
075e097341995dfe156653b7461715d69cabfbc057de5f4a0404993761d965ac

SHA512
be03b5e4a5b1a7dbb93646e2c4999ff094965f2eb7712a7d09f5c69835b8fdac2d87194402929b0cb6fa4a6a1490b63f7cb8a51da1e05eb594af0c2c7fa3b690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
cac32f149264fd9937730870ec8a4bc1

SHA1
05e98990109286b030d87b0a1634dc8593da0a4d

SHA256
8b5dc2c12dc33049fb3c6aaf56f3c127ea29a047dd7602f183a198c193acc758

SHA512
8900957d847c83390612cfc95fe3d59397160d1856afe97d519a116ed9c442a7db78a23bedd51b406e912d8886aaaf82b23f3ddd7ca2c4fd274335811d1ee635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
2e87106ecf4015a79e5998be92b51f55

SHA1
4653d5ccac852653c1fbe0317c598f7020fd2d37

SHA256
645c70b6d52f962859f6723853684fcafa1fb51545185c95ac66abb046dae0fb

SHA512
ce02db1dffabcfe8335247c8353dc76865b89b349e85a32d3f8fd136fa79db76975f44ab5840205254c6d061dd2d619feeb33c453a0cedd8ee23368a830bb2b9

Download Submit