hxxps://drive[.]google[.]com/uc?id=1OiHzSjSy1M4WQt3nvWAHlvT-pO-sSSxK&export=downZOOM7

Resubmissions

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?id=1OiHzSjSy1M4WQt3nvWAHlvT-pO-sSSxK&export=downZOOM7

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
10	drive.google.com
11	drive.google.com
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4784	msedge.exe
4784	msedge.exe
3604	msedge.exe
3604	msedge.exe
1392	identity_helper.exe
1392	identity_helper.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	5684	svchost.exe
Token: SeRestorePrivilege	5684	svchost.exe
Token: SeSecurityPrivilege	5684	svchost.exe
Token: SeTakeOwnershipPrivilege	5684	svchost.exe
Token: 35	5684	svchost.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 3712	4784	msedge.exe	84
PID 4784 wrote to memory of 3712	4784	msedge.exe	84
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4764	4784	msedge.exe	85
PID 4784 wrote to memory of 4920	4784	msedge.exe	86
PID 4784 wrote to memory of 4920	4784	msedge.exe	86
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87
PID 4784 wrote to memory of 208	4784	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/uc?id=1OiHzSjSy1M4WQt3nvWAHlvT-pO-sSSxK&export=downZOOM7
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8266946f8,0x7ff826694708,0x7ff826694718
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11299056638145711006,4008480023727664772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
512B

MD5
bc52092c4abe60fbdfa0ca1594b895f4

SHA1
0c4b3bb017aec924ff0dc6c1e7740c711159b10e

SHA256
d386871321038f5271c3e9103b350f975f2bb90c0ecae5e3844754c7d86b43d6

SHA512
c98fcadc1f51b0ebea948f6bc5e3fe112389237323b8b51cc15dc711fdf96abf66707783ab29093046c490912f86e1f460bdedb0394660dbd3edfa3aa751c5fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bed73e79a73a3140f6f7786bf530d547

SHA1
25af31734e9446d4434bb4c2859cf293d3c8f111

SHA256
18bdd0916b279c7d6fc7bbeca6c4af7304ac01fcaca7cf4ec1674ca807f4edb7

SHA512
c6c534bd7c0acdf4334a5763fb2e681d5b056a14fce9f2878fb9b5717f65764d6ea2435c685a1781aee117ed7393fec69af51059ec2a7b70dc05d6814a59c406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c3e828d00dcbf0144e42a3fa9568754

SHA1
59ff94be7ccf3a2cf0955fcd05a399d3b70493c2

SHA256
51c39a36d72384e93acb109ab7c47c4e3d532bb8d724646c72708d9f6108b256

SHA512
1c909d6ce04c37ac49d04205c60085e000e695c54ed572cc0e1081c1dddbc31c1cde0af39e65d9a800464becd18a6fcee2b52a70865d12856b7c659bd0cb92ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4eff34aa5c700efc1d9b981670d44939

SHA1
65c1806ac3117658c15b85ce1652ca6b15fff63e

SHA256
b723d265f722a0646b45b8be7eb29c7152e5934554e4c87036b2e6ef959a72c7

SHA512
ec0b7bf440eb0963f0a3cb76be5f57f176336e1af630043e03041f35a4a0331cbe43297bec389903a3f0daf5bfd6a764703501566085dd047523eb57a99d4160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d0edc1f027827e998e1924e70e0ac203

SHA1
f465e4de46ef28f9e2446ccbf7aedaf57dba5098

SHA256
2ab4cf69c0760c8e8581545c509618f9543300ddfd05f26593ac6f2c97869719

SHA512
a735dbc0eaa6ad924f9019e8956b476c9dbe011e12cd8bb3de64bc529fdd4e5ecc610381cc11e4ddd4fa8a89ef4efef0fef741bdd295e5c31c7d2789f29cc8d4

Download Submit