Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    53s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/12/2024, 14:33

General

  • Target

    https://www.paypal.com/eg/smarthelp/article/why-am-i-receiving-emails-from-paypal-when-i-dont-have-an-account-faq4172?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000594&utm_unptid=0ff0cb1d-bb93-11ef-b4ef-7140ec9da390&ppid=RT000594&cnac=EG&rsta=ar_EG%28ar-EG%29&cust=HKDXEQNA2EXBQ&unptid=0ff0cb1d-bb93-11ef-b4ef-7140ec9da390&calc=f163201e27aca&unp_tpcid=activation-confirmation-email-251&page=main%3Aemail%3ART000594&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.295.0&tenant_name=PAYPAL&xt=145585%2C154413%2C104038&link_ref=article_why-am-i-receiving-emails-from-paypal-when-i-dont-have-an-account-faq4172

Malware Config

Signatures

  • Detected potential entity reuse from brand PAYPAL.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.paypal.com/eg/smarthelp/article/why-am-i-receiving-emails-from-paypal-when-i-dont-have-an-account-faq4172?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000594&utm_unptid=0ff0cb1d-bb93-11ef-b4ef-7140ec9da390&ppid=RT000594&cnac=EG&rsta=ar_EG%28ar-EG%29&cust=HKDXEQNA2EXBQ&unptid=0ff0cb1d-bb93-11ef-b4ef-7140ec9da390&calc=f163201e27aca&unp_tpcid=activation-confirmation-email-251&page=main%3Aemail%3ART000594&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.295.0&tenant_name=PAYPAL&xt=145585%2C154413%2C104038&link_ref=article_why-am-i-receiving-emails-from-paypal-when-i-dont-have-an-account-faq4172
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed61946f8,0x7ffed6194708,0x7ffed6194718
      2⤵
        PID:1628
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
        2⤵
          PID:2956
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4284
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
          2⤵
            PID:3472
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
            2⤵
              PID:5096
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
              2⤵
                PID:3332
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
                2⤵
                  PID:3684
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2912
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5320 /prefetch:8
                  2⤵
                    PID:3716
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:1
                    2⤵
                      PID:3932
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
                      2⤵
                        PID:4460
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                        2⤵
                          PID:1128
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,5972976230677968003,5644988106894514886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                          2⤵
                            PID:4640
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2968
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:1952
                            • C:\Windows\system32\AUDIODG.EXE
                              C:\Windows\system32\AUDIODG.EXE 0x304 0x4a0
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4240

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              fab8d8d865e33fe195732aa7dcb91c30

                              SHA1

                              2637e832f38acc70af3e511f5eba80fbd7461f2c

                              SHA256

                              1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

                              SHA512

                              39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              36988ca14952e1848e81a959880ea217

                              SHA1

                              a0482ef725657760502c2d1a5abe0bb37aebaadb

                              SHA256

                              d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

                              SHA512

                              d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                              Filesize

                              18KB

                              MD5

                              c5903341bca5e0c2a6f41945a5570db1

                              SHA1

                              34e7bfb4069c2f0b8544968639c936351227b22a

                              SHA256

                              a81de15cec41a9a87a7abf24225e8c5c7f16250bdb6effd1e3b2ebc744e987d2

                              SHA512

                              0a7f618d82f89fa7f457d78b9ece105fb6d17febbe21d4a21f1c35a411782dc634e088365084e288f6f4a2876b32c4a19ed55408d3e23f45c7bd56d14e81de95

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                              Filesize

                              31KB

                              MD5

                              ab92f0360081c3fb6fe11b2d99fd37cb

                              SHA1

                              58a592e35c999c3c28de779c1e67ce0d629473ff

                              SHA256

                              60efbc977bcd8ba224c61cb3206eb8814bfaa63ec7e0480c5ea455d7289f3b95

                              SHA512

                              75bdfc9c4a7521fb8e8218c4957b8f8ec7284ebb9a3c5740ef1f10d2879a0ff08245961853bcd054fe3da6f1d407c2ae96375ec28b8f7992ce31f380c9c1168a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                              Filesize

                              38KB

                              MD5

                              fb58d9b56868a7240430920dc56caf65

                              SHA1

                              e3271ae52941813d4881450913a9a72ab5c2b8ac

                              SHA256

                              f080137398793254f065257bcb4e10cdf94056093d54a069edb660bd6a2ff59f

                              SHA512

                              ab8a5fdcccba1582f1a89e3a091b9163609a72c3783c315d4dba7a1add3f0117b26bea1f1235c66eb8991d2b20bed6e34db80ac11475f4366aa3ea7c71e4efbb

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

                              Filesize

                              27KB

                              MD5

                              ffd85cc61ccd65159fcb43f6c88b8b72

                              SHA1

                              18c8b7a72ac8c3acc8a3ab8f6e42d313c5267906

                              SHA256

                              09fe33b23e3b589118fcdbae6f3e1406ceb94cf8bf5dff3798dee95bb12f8f73

                              SHA512

                              4d3f2c6f6b9e4b31449d5850fbe03e530366c063a7b3d214a39e2c1b51ce55d3a9ec0b26ae356a122405f72cd2258c38589ac807c42696fad36e79f9b43db576

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                              Filesize

                              46KB

                              MD5

                              84d3cfd40803435591c5f98361230087

                              SHA1

                              dc43499a25a3623810d26aa7c19c7162ee15d1e0

                              SHA256

                              699b8301c85187da3e99a58f7e177e5d83f34e75956800f0045a39e706886cc4

                              SHA512

                              fda85e5f71438d6c7fd730a8c91b00b7c2c8208b90bcf13b9c71b78e539d9b4e7a802795f2bd47852342463f8c5ef3e6ed31b1ae689e09704721a07916270d1d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                              Filesize

                              58KB

                              MD5

                              0cb69cf017b035984cf34440d92a9fa5

                              SHA1

                              a1e776e8f650c6b67edb6f9018538eaccfe8bf0d

                              SHA256

                              bba2f8b6133c2f4524b47f473396a792ed3759c4106c96cfdd55205e7a1f3c9a

                              SHA512

                              5e34f05e396e57a71fa51c4f4a921f1d61defcd9290fdebe6568f7dad17712eb471694851b1f4518cd8d777bd47125d7054a4db7448934b87e061633135435a5

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                              Filesize

                              704KB

                              MD5

                              c0197fc5d534150d18030457cff186ec

                              SHA1

                              942cb1f18c84034c2b6ea7c2006590822dc25027

                              SHA256

                              ddbc871d8f1ba903caec3b88512195738254f65ba7337676f68311e3729e7aab

                              SHA512

                              57847020ce39914888aca97ad48f74e388e801f4fc480231412ae1fa436e3ab062ea230a140e4158f3559e85165cc5afea503e3552d8eb7993d62a5659dd817a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                              Filesize

                              163KB

                              MD5

                              8ebc7d632bfd812528ed60b7bc952563

                              SHA1

                              6dc66f457c144a001232ad3157b7433b6317d5fa

                              SHA256

                              c7815790279f814c6460a5757546ca423cce03353bda6c212a776504765101cd

                              SHA512

                              86011290acf54d564a9e0382b045c3775ba50d509c2691255156ca41814c1ea77a89c5408f2f6221f4834c3788cd67a32842728cbc5d3d850395983d6f4b1719

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              5efad2aac78c58b26eb4e6ec637cd4e2

                              SHA1

                              3a15a88fd148d516e2797f6b9201af48ae17556c

                              SHA256

                              a257998a018535586a1c0eaa3b2559ae29c7accd77b3402b48183972255120f4

                              SHA512

                              3d253db89244251b8ab0063a0711b20467fb280614e720a1eacda623263c57af2bf89e2a1b1f79744739988904d8e6c817884d2c5219e101da22445f380c264b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              0fd3c44a2ca1a3d3f5d32fdb846b5140

                              SHA1

                              bf8f61677cacccf248dbd6d9d606eb501c840b09

                              SHA256

                              fb0484cdde79dfeec64ddb7abc2a2c158be5d4258667b496d6be761cc4872016

                              SHA512

                              ce025335ae980392192551b467237c8b622bb7b2e05290bb6d124da6f44e54a6c9cccfda8a8006fbd6504285ec17466dbf9fee24ae5d8d62e45fb47a5e59eefc

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              b204bdaf047b8fc4a80aaea220793ccb

                              SHA1

                              90046539c892fef796258412e13e6b3f20e52439

                              SHA256

                              93c420e0b9e74f903e654ec34da87ac4bf38ac4debef86d1f052cc57b197a486

                              SHA512

                              8c96e83b1541c4ca203b4d26361239105c9c51ccbef95f5cdff9bbd84ce6edfa3ade7ae0cb0974e004b5f5de8a562ebeff2e793eaf9552686362f86483876159

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              85871c0e22db9e2746cc2746673e995a

                              SHA1

                              c69f2023cf1bcb30221cc7d0bc5c02b18f87dade

                              SHA256

                              69047c211eacad76571062cfd8da003035d19dc7cf4717171be2a2091aa730bd

                              SHA512

                              4e8e93a28af3989eae5bd00f36788ecac16c7d4dd632b404f120b6f9d21a8637c78ad66e189f03d98207fbd681c0378c6f186c415ba7a9a2752dc58338ae7461

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              531B

                              MD5

                              7d8218de89be831e08c0916a75aa5785

                              SHA1

                              c7ba8b3d4d003d29b2795a11f7ad84e93e283ff4

                              SHA256

                              29f8daf1ac4e2c28b2d3ece5548828a395aac87ca30633ff2803ef3df9de160d

                              SHA512

                              c8c89f178469b4d13588998ff8beb3b9ab84c6a805dbecfdbfbb4761cc9d9aaa41bb2b7500e6585ea844921eae1eb088fd9bf5016be4db6c7aaaef4acbd25621

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              535B

                              MD5

                              9613b51f4cb9a9aa42ad24caf848c60a

                              SHA1

                              85d438b31ba2ad822beb6cff9f1f05fc9cd72f55

                              SHA256

                              ca5aa25b4839c88c29b06e9192e31dd61dcc36c567ab8ffbffa0eefe125a4043

                              SHA512

                              ca7d662ec660f50f59f139b554bace39c98899f5c673879e41643171ebd383fbbef040f720887675e1b7f48924f03ad17a94f296593acb27a040faf5a8a7aa4c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              535B

                              MD5

                              88079368fe1c77c3b73955e963b0eb56

                              SHA1

                              cddda838d611ed8681d4e03bb1e6d0f50c60b576

                              SHA256

                              39e2ebc0876f5b21a7c2cbc591de797fe6d56991a5b2e41916efae3b2a92d996

                              SHA512

                              6ba3c05876c643d4bf26a800531fe0eb89a8524e85bf16cfecb821833c0fdac133c514977b03649575e5eb9f4ea69ac1175edcfc5df367e63d56d3515be25427

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e3a9.TMP

                              Filesize

                              531B

                              MD5

                              b586fb08ee75a78a92f86c675cde99f5

                              SHA1

                              34c98e84888e6e00ed210195b625e76b50e85690

                              SHA256

                              28baa1701292b810c4e2466591d01cde2775e67d03a786fab59e22d3b42c3fdc

                              SHA512

                              474071d7aeac72c9216fb8e4b2bc00eb4c1d1a2b10562df78210b7a7e434961ad61c9db1a8fa5dfa55f02da66a923f2f03211c600367cb013dc10a3cb1b24dbe

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              26b52a50528b55ebe984d8f45dae6535

                              SHA1

                              a170f86a8f6d350aa6e6562e53174f0878e5fedb

                              SHA256

                              5cf930e6406c47d317cd4db5e7110a6c03662d4aaa6e4895fb629a55cce3ba3c

                              SHA512

                              9ccc7a53bd52b91aaf2352bc024e30d17f110d376dafebd687ed88eacd446ea0934cec01972a36abe573b43a2ad98dcd120315ed1523d1225902761cb4f39501