hxxps://drive[.]google[.]com/file/d/1_RVEpnP7H-42DnsVPNVej8iVxQerIpm0/view?usp=sharing

Analysis

max time kernel
540s
max time network
532s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
30-07-2024 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1_RVEpnP7H-42DnsVPNVej8iVxQerIpm0/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
9	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
2176	msedge.exe
2176	msedge.exe
1688	identity_helper.exe
1688	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2772	2176	msedge.exe	82
PID 2176 wrote to memory of 2772	2176	msedge.exe	82
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 4124	2176	msedge.exe	83
PID 2176 wrote to memory of 3772	2176	msedge.exe	84
PID 2176 wrote to memory of 3772	2176	msedge.exe	84
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85
PID 2176 wrote to memory of 4324	2176	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1_RVEpnP7H-42DnsVPNVej8iVxQerIpm0/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed66f3cb8,0x7ffed66f3cc8,0x7ffed66f3cd8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,4126644726228447003,16347325535518937008,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b26cef15e9a3cc82fb429a163f96ac6b

SHA1
718ac4822198b1a21f43b6941d0d8df107fd0015

SHA256
73af2c2ebc9187187d887e4abc8b04561c55f36f7f9cdf20293d522ce5c2f506

SHA512
87f96314ea9a1f394d24de5657e61cc6809c961fd05280b4875a06bb928f4e19dadf725fcd0417f16c93cdceca349dd27dd95d0f8f0f756020322803b2f91cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5efcc43219d778bd14d32016100f2708

SHA1
b06f6726698a68781854bc342a54e06bc4562217

SHA256
a7534c7d125854f7fe662a7951443cad1d1ff0d8d3eb537dde5a381cd3415666

SHA512
6bbdf16b41bbc3ac5d4e2b93683a712d56eb58719799f69cb7240a77f799928b48af2771f76d9d7829846db12d0116e3a8ea6c5d0f02d5e840db1b3c018480b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d3f83d5-1be5-4334-bdcc-646da6a88228.tmp

Filesize
3KB

MD5
86e640449b3510208e715110bbf34d18

SHA1
7a312cfd381e2dbc89e9434618862e89e7babe9a

SHA256
aba09297b0fe69289235e4ebff52fde129f7f90842ea02e4196323760c0f3d73

SHA512
971f29cfea65b17ed38b87abaa971135e0e2bfadeadbc3146cd91ca1d18eaf0945c84c9b42aaba085be07eabbcbadc1d5c5791bf29eecc301f7d46a9ad46282c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67fe0ee4-5fbc-46d1-945f-18c8ec5ba61f.tmp

Filesize
3KB

MD5
7414670eafd568b1d7c244ab226d3e2a

SHA1
a644fabd3fd571cbda62b08d1476965a0759d772

SHA256
e4be8bb84b1117017d8f7956b0697427a107e671ead857c10c67e7f675f66a9d

SHA512
06f7d6d95bf33b7da16c015f5f283acc65c7ac0918b3030e1d52b6cc99e716205842724ba685436672d39d8fc84e34e9fd5a8a5034823de0981909173c5bac25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
5b63d2e5b61888795b1bbb253e0e869a

SHA1
28decfa630cdd09e964f79e0c03ca4fff098903f

SHA256
96ce7f8ad1d79fc9efea665fce144b9474f7863d12177b00804f7ea1f620f655

SHA512
9d236f52161ffc1fc776a21b37ffad2f81d0729021df1a08c7e26235fdaf6d781543aa7761798d37efa8eb8be09cba91d46db4e466a2c6716d275ab798979cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ff86e5feec940b364bfe3e36a0dfda81

SHA1
4eadc0894e847f823c237b541c4ea63d42e04ad0

SHA256
fff1a5b994e5ec62e798f5e4fb8cac5385e2102282d884c730bba1df1cb930df

SHA512
1c3e907ce3d8c372c64487fda088b5d2253ee6e0c90f27b6ca67d2410f9fc36e991f8c0631e8c90ff5e1de84c787719d9625e697fa0b996f99712021e97c0d43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
52e3767f8328ba6be0914e4cdfa8d7a2

SHA1
7c6606c873322e9bcefeb845c22d731cbdf0d7f1

SHA256
a2bdb0179136e0f7e304899b06a48f9230d44fcb24e3e3e449f5e2e20aaf924a

SHA512
13d16bf405d5486ef29139ac8e3cefa9a3764d0bf2bc576547c44dd1a14b8e800d57ba220d5e1f77438090021c2a3037c2a9ae5047fd8de67c4a3e7e48fdbc70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1c65c7c09038ba1665ee3fa88bfa78a0

SHA1
daf7930ef65790d4a66e05d08e2da57677ce0990

SHA256
7ae34074fe0ce68a771f41c955cae8a319ad31a454a590c2f9476f42b0149856

SHA512
a18556ed1f061c26067b197e5538a393d507abae173df17d6c6527c57f51bd17842ca231f4da8917b8a3ea2c51600d687c114ed31d7b3f9e263b35ee9431d410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
14d47d0080847b952359117de8d61de3

SHA1
bdf678788774dc7787536eeabb61e7fcb8b106cd

SHA256
c17bb469ddf4fb14f6885354c793012716926f780b1fa910bd7408ec47ee45f7

SHA512
8fd6109fce11aac50b6a51a94db33577300f77a8ceb0ac64fe0b8e1d06f3768f711cbd469abafd17295061082ceb47ca5e6c5a953261f81b6b3af7f34df5816a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
35a374c66145a8611e182fd4bd8a872a

SHA1
482901378f8d886eb1ba8dff3447ff8d5779030e

SHA256
ae42e64eebb82f23b1847e39c474c289655788e480647902241cc7f5ec1f8a2f

SHA512
4882197fefa970072c52199a03f6642161ee63079204f90b405a8c27b96bf515e8a3b4def70d4dce0366912580eb1d777c8b1dd4666c05c1e07a0df75be9320b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c31836a676708ce986637d7d3fa9aa2b

SHA1
79e4e66d57c84c01e5e08871c45966609fbcab35

SHA256
8cc973393bfda5855adabc45fe59844bedaedea13887a343110dfc66abcb489d

SHA512
1d2e6aad5368b78aef4baee9302e1489e69925296ef213d2adadb0697c0ee98ee8c36afd0597079bd8c7e79fe52fa8dc3dfd93f315b63fb10f7f0d06b5891b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58a26f244633de7e43b974dcfc5e78ea

SHA1
4f2d7cced0273cd5d39b49155a05d65773c61b36

SHA256
17db52d119a90502dc616bcc5900bcac83fbf55f90ee046fc8a2e1621178473b

SHA512
5cb3a1133a4670c6bd85847c803cf8fa607d28296c06e507805ca8e1a01e4840d706a525de705e9c38d0ea7d5acc9ad3d8302c6bf06ccb12f9f2ae04a7b397cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
404181ff15cc4e091ccb3c4cdf57951b

SHA1
cf3f2cb8ad7c9f9953caad1b07ad6b66495d63bf

SHA256
0fd80829cd5be9ac9b46d0d2d8b31c43c0467dac7d09921cdf9881d398d4d0da

SHA512
f96d9e37fe60c80b7c1cefee8edb90b3353303171ddaec83287a136e2f0faceda6f07a5a7e829866621e402d4c801c6c69a66eb983e143b4a1596cd247138a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3d17a93321e8e0e04616cdb85082c1ce

SHA1
42bbd71ddf9279e9c7ac9d075bd1f4d6353a9a96

SHA256
33cad001712034fb541debaf6ddfd3e9a008d052e1a623cfde3cd365578991dd

SHA512
eceb1a734524e41b1775ab20c267773c673cd127fa91df8d67ade67b34c429b4a739b165851b90b78a7ca44299973e2926dbf343270f6889aa5acaffa5158fc2

Download Submit