hxxps://drive[.]google[.]com/drive/folders/1h40trwDiWRYD-NO_cJN3aMJ_R1_p6_xP?role=writer

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1h40trwDiWRYD-NO_cJN3aMJ_R1_p6_xP?role=writer

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
13	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
2876	msedge.exe
2876	msedge.exe
3004	identity_helper.exe
3004	identity_helper.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4656	2876	msedge.exe	83
PID 2876 wrote to memory of 4656	2876	msedge.exe	83
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 2132	2876	msedge.exe	84
PID 2876 wrote to memory of 5000	2876	msedge.exe	85
PID 2876 wrote to memory of 5000	2876	msedge.exe	85
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86
PID 2876 wrote to memory of 2904	2876	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1h40trwDiWRYD-NO_cJN3aMJ_R1_p6_xP?role=writer
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb397546f8,0x7ffb39754708,0x7ffb39754718
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9371102949591793053,14024811855563113065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6adea331-5c55-474d-a0b7-a64cc1fc0ff2.tmp

Filesize
6KB

MD5
f013034bc0b46ef9f76a4bd40719e783

SHA1
c5c974a967622a66a5165b5bca61abf3abc4e5eb

SHA256
3d2ce6c1b25a449fa9fc553d783c1899d501c230fbc6ec0f550b2c61c1e4aa56

SHA512
7d45669469f31dfaa1a1693883d9f95c819c78646debf5b3d1f679d1c6e1228a130505132404f590e0beab2b6d4f2e398a631376aba2f53543feb584cfcb22d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a9e5dad1af6d6db717b5898a8bfa80fb

SHA1
20438707f6899a62c0348ea08dd9b03a64962fd4

SHA256
c10a475732fc0bf866622b85cff6c3dffde4bc949e2de0079871117e19fa2e04

SHA512
fc31e18139d07b62b887cc1eefeeef58ee62fbfb08418ba8dfca7a99a9f25b7beaa70cbebf5664eb6309e125e7eb845ffb224cd64b5dfb66dedc321c96bcf3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6de5e0380e89f17b914deddc42aae6ba

SHA1
523e1d4793f54ef44c159f59c606c0e2710ffc96

SHA256
84dc9df2adbd6c6f91953412d3a4be8a0dba13c01ee6916a1e1ca143af115319

SHA512
64c76ff3f3db54d119212a52c3dc097a6b579a771fcc157e46045a7c6fd5a58c9e7bf9dc0189b3f4bf214f0c560ca5ddde01f3ee6859b937ea5f1128a3f126a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
37e94f71f0164a5d8925d2169c002eec

SHA1
06398f2ff07b7c762821788a33d46237d874542f

SHA256
614d74d0399a1e2039a33fc3c1b8e9058036ee151434d6ed3ae247b9d8158009

SHA512
bbb78c49c5ef639025ed8e4458de19f00f47c23ff0561fc4c9bc55a49584155fa73471ddfe178af533412ec1d8f6860bf64d6679304866c0cb7a0e6e79a88562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8280d5ec32f453d323b1df2369513e77

SHA1
a5c6eb867522ac68cd91be1bf5fe2f3e8991ebfe

SHA256
392229373ac850cfcb13967c7ab23823cc23f9608d771d5a27de530968a3a602

SHA512
52fac47024afaee4ddb9c6ecdef2775551b590e4de536e2090679049ae707f25e0a7accee433c415751bcb67f494d29a4409e5bb99d48b028b7c49bfe16b058f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1e83ec31559ee12b2f59df1e149f12d6

SHA1
be9faba56c485732e95bdb1c7250d456dbf13e52

SHA256
5c2dffcf3e46c1bd1c6d415e57800a1d136cf614a177f01f94be7182478fcfbe

SHA512
b2fb3ead7df86aa176b44979fdbadfda7e2ed173629de4097b54bd4a4a3e13a703f80c7a07cd8979d4f362c897c8157748eaf611193d5022cfe3baa9d407044f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c9a4.TMP

Filesize
1KB

MD5
4bb6b7926e7da6bf6d21b85e900f2d67

SHA1
afffdb5640824dc796872f931c96bf57d76efb19

SHA256
c670dc43250c382bd68c6554782cfc8216b499d3b1cf536ba2c2eecb85d657fa

SHA512
edf8429d21415c881d66157f85f2169a090e0e0f560ece8198ddb9d12449b0cb4d79b4fa9b56d37481ede7d0be62411ca4334ea4554b625bfe8581d7f4d955de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e1229462f0c5a25888d384362e545716

SHA1
35dcc8315db4f7a70e9513096561725545c6c83b

SHA256
4ff42f4754b2067b3231902a157d333fa4ef50ee6b1a5ffa2613209816426483

SHA512
e2d79604f6ca07258deafc410ad3e3d54e9f615bbc722ee45bfa22481dad03f7a5a351e5756a8bb395747ab248dc168495a5cb3f91f6d0bd2f29381d9acd8441

Download Submit