hxxps://drive[.]google[.]com/uc?export=download&id=1qiGFtovPo8iSTFMbtlwZHUl2_mPjSIxz

Analysis

max time kernel
112s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?export=download&id=1qiGFtovPo8iSTFMbtlwZHUl2_mPjSIxz

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
9	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
320	msedge.exe
320	msedge.exe
2700	msedge.exe
2700	msedge.exe
3488	msedge.exe
3488	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4236	2700	msedge.exe	83
PID 2700 wrote to memory of 4236	2700	msedge.exe	83
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 3712	2700	msedge.exe	84
PID 2700 wrote to memory of 320	2700	msedge.exe	85
PID 2700 wrote to memory of 320	2700	msedge.exe	85
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86
PID 2700 wrote to memory of 2040	2700	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/uc?export=download&id=1qiGFtovPo8iSTFMbtlwZHUl2_mPjSIxz
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff8bd7e46f8,0x7ff8bd7e4708,0x7ff8bd7e4718
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5720042834217772879,16376009613286939374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
710B

MD5
e3be6e6e975f732c0ca19e10a4f7f3c0

SHA1
8182c9572ab1cad7656e68ac0d62b8597ccf03b5

SHA256
81cc9454e28331c8877cc67450ece3554a01e938da39c3f51717056861dc42d7

SHA512
713a6d2b80ef96088773fd5c3930e582a3dcf3f411ea006f96a69cc27165a190c8c9b20e96529a69819c8bcae8b4ba116df1faf2e43e4365699fafb79850d27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0255840430d78fdb5ef39a2fc9cfb76a

SHA1
69d24fa407c4dbf9353b63e5ec0b520a7c25a9d1

SHA256
8651072d7c032d833918c10e2ca5bb26d259980320baf42826755a806457a492

SHA512
c7f10bc7c65253e255c2dec1cab5d985a0ad231b0477c8db8fdaae34ba896c6507cd831a6f1587055805e280faee8d80dcf6ab169d9451ecb90fdaab3806d6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8614811fad3e8dbe26a7713e01bed562

SHA1
0fcd6eb61ebbff0e5162712b79857ba3a56fe95c

SHA256
f1221104840966eeb174b251f991a496bae4268a7d4ee9d2c5ad85836d53678d

SHA512
92176e3406ea9dc5f523157ca4ff2710a88709a5bf615cd411cb8252623796012727ca887941798c51653b406dece43df48805af9ab0640aa9b6d491ff17e902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a281fe848f930da7d907f6b904b4baef

SHA1
a0d732ebd742c1eeb656c4751cfebd645e40e5a2

SHA256
43a2ad715c8cdf5b1ea92b7e8c2223ad989310632d69febbc8cd550ad2f6ea31

SHA512
442b319b7648bfb915092355ff2b21f47bb6bf1279b9ab6697d1f17f8e1957807e2499ca2ba5f2992805f3ffbf2960b3718ef0da8f7671a187a3618f61422946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
5e20c1b027cd8eba241a61109877eaf6

SHA1
39bcd24ccf4e43b743ec4e7094b982c10e6b62e0

SHA256
86d4ada0a82da389076acfd0b0716a621f5288d9ce36fa78b11bfbb082fb367e

SHA512
7a26a3893e8bc21122fdf342a3999cc0613bb59cbac618a2eab5a1f7486d8a646584ccd4734b723bf6b452b52ca1fd79c6cd6264e3fb39a265d3315065440633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
ee89a6f50f939e00e7877e9973908ed5

SHA1
9ede5aca15b7d8b074c857999e4ea27623d63c53

SHA256
255fbbf5605e7a1dbe21a88d32c96b75cc1b82e7bc0b35076d117edee4470226

SHA512
061784c8ce0e3bb49da38d9c4a72294564900921665606b1e8214f84ce62cf6bcaff0516f6a9d7787444b5126d7359ed0c49bf042eb475848f1f0518932ce102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d8fb.TMP

Filesize
204B

MD5
44dba67a42ca964c7b52da26bf2ff5db

SHA1
e1eeebd82758e6054ec248ebeeb8170b6476f9e6

SHA256
be01634d8b40500f764f7dfacd459941ba19b4fa207ec0081d33d0f71304b9ea

SHA512
4d9e878e5e3ab010174dd14b30e34dbc85d59dd7f185806dc19c04b068dbcba0e9e7b26c26c79cd6a99961c37864eb5f3bb3e87936c53fadf1bb41a32fc184cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0b2a3bf2b8289423b913836ffa6d12f0

SHA1
033325ecb92a4630280a1601525574e5227dbb60

SHA256
f3a30b80539b311d9068b80ab3d6833fc8fccf9e48a819bd8aab12022ff750ae

SHA512
9b99fd53440e8c10332935799ab704fd8bd42f4f51bbe9db1f6f5558a4007245cb26cbd2fd62372fbca1b18ecf1b1836f6fdeb8f7455f77a8c1667cecbc09582

Download Submit