hxxps://drive[.]google[.]com/forms/d/e/1FAIpQLSevii4-RcefusTn3tdFHlretJVBjkpDw1_wRRpoUI1zt9M0lA/viewform?edit_requested=true*Z0Q36lRJ

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/forms/d/e/1FAIpQLSevii4-RcefusTn3tdFHlretJVBjkpDw1_wRRpoUI1zt9M0lA/viewform?edit_requested=true*Z0Q36lRJ

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
208	msedge.exe
208	msedge.exe
4432	identity_helper.exe
4432	identity_helper.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 1904	208	msedge.exe	83
PID 208 wrote to memory of 1904	208	msedge.exe	83
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 1888	208	msedge.exe	85
PID 208 wrote to memory of 464	208	msedge.exe	86
PID 208 wrote to memory of 464	208	msedge.exe	86
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87
PID 208 wrote to memory of 1604	208	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/forms/d/e/1FAIpQLSevii4-RcefusTn3tdFHlretJVBjkpDw1_wRRpoUI1zt9M0lA/viewform?edit_requested=true*Z0Q36lRJ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb29d246f8,0x7ffb29d24708,0x7ffb29d24718
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6501337329163637294,4824954586350000831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
696b6293911cceefe6af000b05848e0c

SHA1
ab7f68b4c61b0b1fd0778f1ce2d1348b2da80037

SHA256
7638aed720a2194cbdfe18ffec8279edd4400db6feeb46256ee0f80a65703917

SHA512
66c3c0d681ee726d0ad079120bfe2be95a625064565bb1bffa7eb7f12268045503f5aa984edbbb97ff6baf50fb0179d6b6bfdb585d94f5ee73ac1512ca463752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
174e09cb030508c155fdc0fbffa2a8ca

SHA1
b35bff482d4e390b93c57e799188304356200504

SHA256
2774a8990ba3c656f6cb3f57acbfd0a716a2c745c358fc24fbe2fe4dabb29dd9

SHA512
f5bf1f6470ef3f000020e6c7f395779dc242451b3d05c82063c3b47902d89f5c9906eff6b3b1909a06917a2740b88f9d46408bbbf2a343671cc4e255ec171d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1bd1210098496c7732674c27b73c8da0

SHA1
d1e5a22d4c2069b857a16060ca2de009479d4158

SHA256
6f3f89c6cdbd9e40cef8cf9c82a794f6ba65a683385a8dab2e9284ec7b1b7be8

SHA512
45748913f49afc8de766a63c1eb6ed7a9690551234c2946d54f0043be3a1dea31b47b3c175392439ffb0560c72eebbbab99cdd7c533c985dcca5e41342a2b36e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
85984f0ed4192eed327d8faf8ad6efe9

SHA1
17784b3483ab9132d667d2c7d91d23f44d60446e

SHA256
16fca5635b16d638a254680795592bd08d1b2dd202cf3e13281f71c8ef074f4e

SHA512
85ab83dfe4d917ba2684a85d882020c260975b24d448d7238a18ef1ed03fab4d64ead42d2c38825d18c66e99e205be7a7ab0582bab21a21b63055bbcc684b984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f98cce43ec8e20443aed54fc2dd71a6

SHA1
00c214ca2ea5a06cc638cbde72480e7f459f001d

SHA256
5e429dd5074489000772579633ae67ede780b863658039095ffb87f1b670116f

SHA512
ce72121282354679ae3434fbb8eb69632f7058bb6f86c132a0ac69c6712f5e00096a3862ebe32fe9fa6bd9013143da6f9f26cbb010fdcf34d83f2e600cf1437f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
79b1b89012f0811965dc7574301888ca

SHA1
c618737d42bb1aeb83903b59839b770b932f493c

SHA256
3f7f566fa1f02e1711ea4c392e0ac6f08b2eba808673aa1a3ca09b319c9e9a2f

SHA512
844a5e5b9a52d363a0c03282f4e956695dc56153ceb57172c285d89f221da3dbc0fc0b1208ef52ae8ddbf1025803d724b4536785016f3fd65f45469322b509d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a58648fbc5fa0d8115d694b5d7efeaa4

SHA1
a6b77f816283041bbcf9cc064462ba7fe9fa9d59

SHA256
c1fc63d3a78b712acefcd0dd74fc8efcf12fe514813b17dbbb26b89ab80c9664

SHA512
a0143e8f47fe1540b57ff04f22d8064bb52b36f7f963215b2cca72e6b0ec80a72f629c62ae9fe163ef2fdbc86d9f8b6df86d89f020a75acfb26595a75da6b62e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
feb16c3228ba192e448b0b5e67b4ff3f

SHA1
96ed4f6c9c990a2bda390c97189d9984455573fc

SHA256
80576b04d5f34082e5e3f56baaa4f806835f35a1c8011c494fd4dd08e3a104bb

SHA512
22b516aedcb657552f38a838a3f24e2e9d50ff865b2ef46545f7e8a7064ab030ba5172a3473a3ae8b15e773cd0eb019d1596c719190b1b8de22cd413f307045e

Download Submit