hxxps://drive[.]google[.]com/file/d/1UHMVgkf2LeT-bnilDmI6vmwFdQ0DgyHE/view?pli=1

Analysis

max time kernel
523s
max time network
527s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
22-07-2024 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1UHMVgkf2LeT-bnilDmI6vmwFdQ0DgyHE/view?pli=1

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
3	drive.google.com
7	drive.google.com
8	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
3316	msedge.exe
3316	msedge.exe
460	msedge.exe
460	msedge.exe
2904	identity_helper.exe
2904	identity_helper.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4564	3316	msedge.exe	79
PID 3316 wrote to memory of 4564	3316	msedge.exe	79
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 3856	3316	msedge.exe	80
PID 3316 wrote to memory of 2500	3316	msedge.exe	81
PID 3316 wrote to memory of 2500	3316	msedge.exe	81
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82
PID 3316 wrote to memory of 1688	3316	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1UHMVgkf2LeT-bnilDmI6vmwFdQ0DgyHE/view?pli=1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8236c3cb8,0x7ff8236c3cc8,0x7ff8236c3cd8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,14074023638025415095,12410528750358895676,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0f062e1807aca2379b4e5a1e7ffbda8

SHA1
076c2f58dfb70eefb6800df6398b7bf34771c82d

SHA256
f80debea5c7924a92b923901cd2f2355086fe0ce4be21e575d3d130cd05957ca

SHA512
24ae4ec0c734ef1e1227a25b8d8c4262b583de1101f2c9b336ac67d0ce9b3de08f2b5d44b0b2da5396860034ff02d401ad739261200ae032daa4f5085c6d669e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6f3725d32588dca62fb31e116345b5eb

SHA1
0229732ae5923f45de70e234bae88023521a9611

SHA256
b81d7e414b2b2d039d3901709a7b8d2f2f27133833ecf80488ba16991ce81140

SHA512
31bacf4f376c5bad364889a16f8ac61e5881c8e45b610cc0c21aa88453644524525fd4ccf85a87f73c0565c072af857e33acffbbca952df92fedddd21f169325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
bbcd305f6f46b9c35b41550ae1bebe6f

SHA1
850927e76f5e846338fd1a756b5ba8702627361c

SHA256
a69d09507daf514880ccb620466b62fb3899fe56e4fe022a85ea32fd2fab7314

SHA512
c8badd77a2116acdd0fa680a90ba9eff850e1a1cddc988b7a24837a4afea294b63d6e1d9f8be69838abb6ce8bcb7686a54258b36c159d7ea146f617c782b4d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
15dc6bddd0e989a724fa6b08c98c2948

SHA1
fffd1c6eebbc125f494f1ca75e763f2611fcb05c

SHA256
903796ea36789e9165319e1bdad2ab79094315681d1c5d91cb2eef8c0fc03d46

SHA512
760793e9d6355af2049a06f5f7ff5c283feaa56cea8a91f4c13937ce052e73782d27b23dc1fcbdfe1e7a907c3d71097f182bbeeb734ffe15f5caf864e9959952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cae85ec88406df7cd9996021be042e96

SHA1
34cb4ff8cc3018a1f1dc1b23f182f6a8d5f0e15e

SHA256
04f2719304d59f36673033afd4b2b84313da56658bea1672a9f41a51238f3214

SHA512
d37c6b7d376d4607539e5deac925719bbd63250174dc3fb163fda3f94f04b7020ec9f388ebe6beaf06d57d0d5e9625d0e10fa841a2ec49248a61edf3fa332250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9a194ebd5f2c01e75213b537366973fd

SHA1
fe7a7130424a6cfc8fe90d23acd91dca9dcb456b

SHA256
89d6a1623df67c37bf114917b8da256e5410cf76aceb0b6f2b5dcefe27f85462

SHA512
af20c71d923809c9f44bf5c3b327b49be3e420886b399917f68b839936cd35a4f2ad67588ef4b5240c0c5e91a1cdaa1abd98037388d07e5eaa0147f6842d60ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f00ff193eb69f4dec53e9d8ac358fda0

SHA1
ff9bb349935180660d7d16297f784815039ce64a

SHA256
c5c9142ae1098c13607e9cf0e5b2ccba454858b73edc0069530e6712df0a9f6d

SHA512
b2f2f51faa98eb20e630431cd289305fb15f90191a6e34d4fd0dd013cdb288a67108a3413d790a24f0d1537752516e7dca797f939e0438df250ea82adc8b05b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4ea5a6ac02b8e62f156276dea7c134e4

SHA1
3e3e442e9740dc0756c5f0be2b98e4cc9e4bb542

SHA256
1a0bf68eed4ef0d2b3b10b1aa5a94a546a95ea812594b076cc581c3f05b8f340

SHA512
982ecab7db3873f9bdfcddba5aa2f8cd9574dc4ccfb84a034e6b83ce703b269c1cce2371618953fe8992a62671feac39429daccdf51d30d0c92a8bdd0e7e4af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
916b47f00ec148049ab2ac674a6ba456

SHA1
ec05c787560a4f2bc0edfd660c9400eb57d28311

SHA256
47e51f8e0f090eb9d97cd50e5924c3ea8aedfe4a5e03967430b48b477807ca74

SHA512
1ae32543d034b9e788e55a29649127a9b5ba74a6bc386fd63edfaca70064af38cb4e6ff55351f592798ed8377c806f121a049f1dfaeffcc2aaf5faac6d3bcef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3e1e09cd4b81458e19aeb69c31f24b82

SHA1
6bbaca81f2b0d8b471f05dc3aaf7ac9ddee6318e

SHA256
87d298f9bc8de2583ca88ba93d780d2f3037fa259e82c8b3780abdad4618acd9

SHA512
d03876ee607308b4d6d693e7dca3b48c04a46061d9fde597570f496560fba4f2240901d0e584848fd1f6cc1e209c539582737c00d21cbba2c01f421d4e434a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c0a8d3bb1ad876c231c3fb6b7e1a3cd

SHA1
37c9a14d24067d8af61d11caf0611e85f37ec219

SHA256
f28c550c07bfa3036cd033758347fb60851fbd33ee5faab9948bf3d1ad38c131

SHA512
3cd186971985e5aed887bc226a83370a300f62d36f4d053b8b49e17436d12d8de07744e0d0773624c4f53d2eef828c1cda9e720f4b10bae5c92fadc5aff49679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be956d78651346b4970ca790e6e181bf

SHA1
249aab3423bc4c296a0c6211631771a30874eb10

SHA256
12cab3dcf60abb901a8bb1d5945706b2e30b076586af023d46f88981dc79ab89

SHA512
37cb9f6c712e3f0be3402c4bb170eccae86fb648d9de748cf760fab74415191648f6e61de1d29904bbb0b68ae03d47f25cae85b1a59522b5a248166c85b1b311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b8ba232636c6b6469b72f86772ea9bc

SHA1
2aeeec4e2285ba3afaafa5e091ddde57a05f3aaa

SHA256
56d51c428786d6f8276bcf7f53a7c6f31cc6e8d7d4108c1aece0f40108dbe0d4

SHA512
3bdd4826d79dd94d1374a02cfbf21508e0ec3e80d3fa1aaabe63ce814c4578a69cfcff97acde2e6b662d666730a32e53195624d80e241fba19ba225f6d3a4c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8e72947228e7b5835c87883d7303a683

SHA1
1e31635a70452ecbc7e9b25d0cc088b1d9ccdfc3

SHA256
bfebf7a0b5e0b829353a499e056fb0f4c990d95746513f0ec0d7728cdc2bd2fc

SHA512
02b608a68a5d17d4fef8f69e39911363b696043e8291a3f9c585c2f1de8473ed02466b3c37020d1ebd3d4fa259e0dc4fbed9258ce9f96266839e1c56a2e9fc31

Download Submit