hxxps://drive[.]google[.]com/file/d/1ZrqqSj30BzOO7yElNxoDV_ZRInPCvCaQ/view?usp=sharing

Resubmissions

30-07-2024 06:58

240730-hrs3qavdmq 6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2024 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1ZrqqSj30BzOO7yElNxoDV_ZRInPCvCaQ/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
528	msedge.exe
528	msedge.exe
2928	msedge.exe
2928	msedge.exe
1716	identity_helper.exe
1716	identity_helper.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe
1780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1388	2928	msedge.exe	84
PID 2928 wrote to memory of 1388	2928	msedge.exe	84
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 2232	2928	msedge.exe	85
PID 2928 wrote to memory of 528	2928	msedge.exe	86
PID 2928 wrote to memory of 528	2928	msedge.exe	86
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87
PID 2928 wrote to memory of 3536	2928	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1ZrqqSj30BzOO7yElNxoDV_ZRInPCvCaQ/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8008c46f8,0x7ff8008c4708,0x7ff8008c4718
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1312 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18146462885928124143,9166564054888806682,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
f4795c90bca4cf5df7f9ccfa2c3291e1

SHA1
058705e563396ec37491f5abb55b507f86566ff8

SHA256
d6db73cb5d7d08ec517856df566187742f44a9139ae48b5b7c8b861d23cefaab

SHA512
538b2e897b79ffc13031a8c08786dfe5f7b0a070b161a5582e282d25fb9be4f6f26b6cc46223171a26884d0875a86ad173e1e1ea744c303b8a0aff33e163325f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ac054c35aeebbf904a77e817b60a98f2

SHA1
56fac39b686ea52b1e8c92e6b495d2d327ea802d

SHA256
5ea4c06710bb818317e74f07fe136a37af92887e2994e909b99a6b590349fa70

SHA512
9dac8eb4906e97b5145419dd3b1a377ff6232e236ee91ba2e4994777b593da6cb7920e7373115405bfc36e7245a8f18f1709326457fce50a035f0010ce9310b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9595c67eb4b3288db526d040dafb28c2

SHA1
40d60bb675a453a55fafb50e49171a701315db05

SHA256
e157f58c33040213e3746b0808acf893de588c8ac522fcb076adafc5fc6b9c70

SHA512
e032847ecb44b417395be2fe28d500912783bbd3dac0faab25704a81ac9f1ee2e6fc62119c3a775b1f37015fd6dd7b7fecec2eaf70e2b9bd5e8d56e2b5514e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5cabbdb1d888da309ef46eb4cc6f7151

SHA1
f6469eedc02ee638ba8988730221f00429e9e45d

SHA256
94d145544bc30574092cd0e7ab2839e31f9f701bd1ae167edb4dec33c017170e

SHA512
bfaa7df874121243b9b7298edb2afbbdf5577e36bf64feb7eb9be23937541123560d21108e2a3c6ad8454c10da3da658383a5eef547b856bd11e1d85aecbec1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6628479843e3cf9ec19f98ae12bdd031

SHA1
251b3da6f4d0c9f98d0d369cbc397aab15d1f048

SHA256
f247e9a2e6efe23699e15c1aabe8d6c196ae8470843e038ea544b225932a3b71

SHA512
81f5852d502877cc2a8f6ca73b0e57996ab6be119450dd091d4f5bfb07e6604432bacf229825075dcac7fe6d24c4afc5bc631fe42cfe187e0e283c1e089f7d34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbd512c79347106b1565eaaa8f92b218

SHA1
f7b8b61c099ceb0be4af14947cf62fe36480a991

SHA256
eab429c225f84a9512e16986f375abcbff5ac7b69e255b9b262fdd6d7390e9f3

SHA512
b6d459c92091247d8e8944bcb047147f3caad92b0256a446a3e1a11a23a7928d21fb5cd79f713f20cc6a2f5972f4cda94539b6785793bf23b976c3b80ab8fda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8bfcd9c6a409369a609cd3353d0d547a

SHA1
54b143026450a6dc4610e9415e351b84ff5b6253

SHA256
87b25de85fd333cdf42b599e0f88b8e0e5f7168dc1bbc1d8eee9ee28e9eee26a

SHA512
f625074fab24785f808b03ff477fce945f4a6090d323880dd0cb23abcbed673fe6840a334f6075992a0b4e1536684ecf7b50a62284c9a950663fad26b06ea40a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4d4890bde214de6118f7bfd7b8f83c61

SHA1
9e457244e9159a134928e38356c2b8e13c1dcf93

SHA256
24445acb90b9fcc71d2079072426bbc84b68925380be05f312a8c7834828000d

SHA512
1b5bd2becc867b135880861ed2351269c6085048f3f3878051fdfdd329f52913eaacce54ad8b731072c1e1f208427d02e93defd46bf460b546ef31ea64d052de

Download Submit