hxxp://drive[.]google[.]com

Resubmissions

21-08-2024 16:37

240821-t49f1szakc 6

21-08-2024 16:31

240821-t1htwsselm 8

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://drive.google.com

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
4856	msedge.exe
4856	msedge.exe
3292	identity_helper.exe
3292	identity_helper.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 3152	4856	msedge.exe	84
PID 4856 wrote to memory of 3152	4856	msedge.exe	84
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1008	4856	msedge.exe	85
PID 4856 wrote to memory of 1468	4856	msedge.exe	86
PID 4856 wrote to memory of 1468	4856	msedge.exe	86
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87
PID 4856 wrote to memory of 2364	4856	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://drive.google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff227e46f8,0x7fff227e4708,0x7fff227e4718
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16078434920544073034,6545006729914633811,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
56c43f33dc70b3cf7d18b1e7ccd288d6

SHA1
84abcdfda64bb87dec77e1ac3dc18485576c1935

SHA256
8c91a972d1fd91bcad3501f40404735a43d77085eeeca5a432d19f6cd7164586

SHA512
0bebab9df2d2cd1cf1ddc123b049bd37eff70984f191a07a38cf05eec785e838e6ee29c2be16fbaf195f2ab1f1ffbcf17779236bab49533ef6ee58157cce735b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1dfb0bc2eaa1d2ca26cada6aa98830da

SHA1
c4e3f0a00a3d1dbad6207edb42629d4744db9472

SHA256
dd6b59a70eac39f8d3c0d6f549d5677a8bb4c58b9fe8706856abcb5061b89984

SHA512
6264f4ed581fa0593f9747ca6bbad518b6ab12f8fc562f360c624a155a50f2e210f90fe0295e659f6ba04cdbd383402e0dc38b686c2904ec080e40020ce1cdfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8c6dd51b9d7a2fb395954e17f22c24dd

SHA1
9ac16f81dda5cdb11247055c5acf2b998423ba80

SHA256
db4aa7c5e2881f38e0ae61db7ebe21d53871bd215e91c3eac0c93d9e19e45255

SHA512
21fbac8e42a44769e83025a486a82486ceaf2e724c9a7f36709fa4b29b593b21702650f1a9f7c3fffbd8ddcba4c08562b8d5605391ff04e8120371aa63a9b8db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c28eeaa86928af928786061f10fc6684

SHA1
f43625475d02bfbbdb3959648b307f265a8e8a3a

SHA256
83e6eee2b810edec5bc172948827d19613faa03d75742785a6afef4b86341193

SHA512
1f75c2f694ee4b9487e552a32c8320c31bbe29cb5c581b72bbca5ef6de62099227fdd572cd8b1fc59823895072686c5a0b9062c57ee0529c056fc323b00dbcc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cfb29faf28f1593b0a5f38c8cc71d799

SHA1
25838b8e453fb5a0a5e7d1f7234c4a70636f42ae

SHA256
9c876eb8229ea55c4fe5d2e97fac809e77593ce50d87696cfd63f5960ba9200e

SHA512
6955f497c9acae7fc4ec8bb78a751c386190a01e14ba1d1f53e56385e5f2c0afafe052e514cd901fd406452fe71f05d1ea9df7f7b75bb79ddbb20e0be9e91cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
fad0ac39de2e4c4fc8065d9263bb6103

SHA1
0fff73d7d1917e2398e0ea1b00eb6f7ec219332e

SHA256
612e1dbc4cb8d981964013a5e370a8184f36c6b5fadec74ef2f0d24e478c8045

SHA512
1e2a5fc74cff2cab699e8576e1ab1d72f0586b41081605f19c892f1bc2fdcf360518065d9b44e0fe1efadb8d099dec9ae23c9477f816c14548b825c1da328f90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
6686a656464653f6e52a6dd39082be6b

SHA1
1ed3b3da27cd4c36065ad1f618c50c0f91004677

SHA256
2e1d17bf5883142140a9595cc7d2437d259292fd18d712f3e95061a5f938a04d

SHA512
7c5896fe7c8735c517d1f3e2b8e6f60a13127a7de59168bca80198d0f79ec7a1029454049781fb1da9a08689beec540f7cdd2215b8794174527b4c5fb456b99e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b3ca.TMP

Filesize
371B

MD5
f4de5533f01a853d9fb9690099edce8a

SHA1
cedecfb904584d7578c383f1d2d3cacba284f7bc

SHA256
2a748616a415955d150a9022d5568e099b83cad3bf8c4d765f93cd79e151eba0

SHA512
4bd298caedb0ca5cdda9845047aeccc2d2c07269ebc9dd2540962e985a8b2ccc5c45e6290af0a2a8ec2b428750d68df99b61754edff47721dde7ffd4d460a295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cff68f41cfe3847d2d67a559172e6dfa

SHA1
ddef7c045de04018258c055797483f5a11ce9394

SHA256
5d404a7edda7ff33b61639c008a35a0f86bf7c4f0e0f19e100e79daa4d616521

SHA512
1f1674064a0176a8e2b974c8d6aa54cfd9d069c6eb10cb88313e2a1867dbebe0b79978600044eb158119a3ba1bb00ed6f4737c31c434d2f71e5183aa31f25bd3

Download Submit