hxxps://chromewebstore[.]google[.]com/detail/pentest-recon+/ndhoegbjcfjdihjjflcdnfmhdbilhglm

Analysis

max time kernel
840s
max time network
845s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
06-02-2025 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://chromewebstore.google.com/detail/pentest-recon+/ndhoegbjcfjdihjjflcdnfmhdbilhglm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3488	msedge.exe
3488	msedge.exe
2652	msedge.exe
2652	msedge.exe
5112	identity_helper.exe
5112	identity_helper.exe
1876	msedge.exe
1876	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2728	2652	msedge.exe	77
PID 2652 wrote to memory of 2728	2652	msedge.exe	77
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3480	2652	msedge.exe	78
PID 2652 wrote to memory of 3488	2652	msedge.exe	79
PID 2652 wrote to memory of 3488	2652	msedge.exe	79
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80
PID 2652 wrote to memory of 5036	2652	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://chromewebstore.google.com/detail/pentest-recon+/ndhoegbjcfjdihjjflcdnfmhdbilhglm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbc3933cb8,0x7ffbc3933cc8,0x7ffbc3933cd8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,5676592740632431908,6513012868465323487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5616 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
2e06aedd7e43c37efa7cc3862b29b2df

SHA1
f0b2ad024a6a478f3f9edf4266c325c62d2a4cc1

SHA256
81ffdbf400497ea4c30dcfb529dea2ee3adc7e0e1eed71818a30e283348cc379

SHA512
7454d8181c6e782ca0a290adc57127676e4797340b2dec096acc1defcb4b04085f30146e2217ae33cd084dc4dc6ce04975c5fc29c4f4d9c0084856731d04c936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d8854629d99f2b9eb05e80580eb0a9ac

SHA1
bf7a31df37dadd3c9be6164294562fef3c416ee4

SHA256
a4664fe5b894b1ff62f9acccec9093732078d2cd3b5f503bc73ab4eec5394fc2

SHA512
2668503a5af5be8b48f941e8d98f5156fc882dabee5efe292ad39e861a8363783241a73597bf5e6d0f5cec9f601a3322018e4760f3c23b8e9cb1f1f229b0fcac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0a92d193b1655913bcdf4a822a98ee38

SHA1
8c08b3e3ff425f6a806191a8da2ff9a3673352c8

SHA256
e05181c9a628da2455d07b1ec788bcf42e868c15b132dcc20fddbe70e5798662

SHA512
608d939a9c99f968bf12875026d0f93bc206af71b0e1816ae3b6a48dd53fe3bf158a7888234b1298ab079b790d3d7055880dc811e161050bef5b382d0454b0a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3e57730dfafdbb718c892f3029002db8

SHA1
87f72eabd271f7e89af667036d3a42624cfe85de

SHA256
d8cc2eef3cb9762ff4433568c8851b5a93e8d13cda1204981153244bcbd5f916

SHA512
35cd678d0794c2552f60942a1f6d556931f38f7a933c64007af03bfc216e436a5bc1a327da852c880998e50c8e0cfd0999f49a0535135a30ceae68780cb37682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
aff50717818c80fb0608cc480603ad0d

SHA1
787c3d386c773a4c82dde6a2aed24423c6f97a71

SHA256
afc335bc987bc3691d541c1c637ab71983e0d674f2f3e87648a3e953b3ffa1a7

SHA512
8d7550e4c8ccf084c28b7d3b5e36b5a04d7e08c7bd580d0bd6b10af0c1b6aad99eeebc026ccd8287de015665a3cd6bbc081ec40bc61933eac13c5372001a67d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebd794bf2e8053e706b413f0b56a3497

SHA1
80da1b09b06ef53a758e29cc072d4566bd87234c

SHA256
5dcada707bdc6924c8b2cd96ab2ccc2ba7fad55a135c6d44f8bf56c661e50b84

SHA512
0acc5d37e0870ea935fb4146ca5b9201540a523b00f2b0af10457ed892505085bd856f0ffad5c93cd7f8f124155bb68f932d01aa7ab18f55ee4831df2e9652ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
82597b79eeede46bf2f754041f905e91

SHA1
3d473687b5b33c4783cea9b81610804537afea34

SHA256
2bb792665e0cfe4d0758b04481890d01608371a77549bfacc6fb158d0c6b1912

SHA512
11384e12f502236f8e29ae8b2ead1384b4c949b5b277de39872cacde4b559a26f69e2343ef8ca5751bcab3e3e564aaa833ee7b53a8e59e8aec62aaa197ef41f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
331d085fe958320cef589002cf321c21

SHA1
11dd878b8fd003aa20272c9e27db521c557138d4

SHA256
299b24897c02877377a9a3400a6ae81c8fd76aaf4cb3b586ae2daae6ac0a817b

SHA512
bb385d380b6291d776e3ac0e43965098cee227f5f83685a6de507a06e0ca058f637be80c9784684df2bdec189c3551879ed756bd176711cdd7eebec1313d974a

Download Submit