hxxps://drive[.]google[.]com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view?usp=sharing

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2024 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
4728	msedge.exe
4728	msedge.exe
400	identity_helper.exe
400	identity_helper.exe
3472	msedge.exe
3472	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 444	4728	msedge.exe	82
PID 4728 wrote to memory of 444	4728	msedge.exe	82
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 2056	4728	msedge.exe	84
PID 4728 wrote to memory of 3432	4728	msedge.exe	85
PID 4728 wrote to memory of 3432	4728	msedge.exe	85
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86
PID 4728 wrote to memory of 2884	4728	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ff840ed46f8,0x7ff840ed4708,0x7ff840ed4718
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17212776560481255508,17776857542635958017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0dc31145339977b457eec605c4e1a567

SHA1
deb6ff8183afdaafd849858c821af52f93936e1c

SHA256
4b1ef876e1d4f2c9726b7b966222c336d0be026c588178ad40ab476be4d353ec

SHA512
ef095404247530ade966bae7d6920f0ff060852e3dfb545f4bbca384f88d0e2a4622b55e4b856ab63f6e6c56196a8ad1257711b53a2fcdd89962d1252b6c4e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
31f5155eeaa8631c1c80614efb4e73cd

SHA1
aac054ba3a9bd71bb2644cc541aad11a5f119017

SHA256
7e0833f04bdc7ed7a88940d793f110d199368d7c2ca55eabb154de84a355d7cf

SHA512
94c43c4e59ae3745fee5157852c279110de2f89dd1562c47627ef960a70790db0b713155817ac7ac636e43f0218f73d35c915f9de61df019ba65c09730a21452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
e39f986b75959bb4f3d2a67cb9554d43

SHA1
b52ee8152de1114bc25f834c3427be0dfaec5b5b

SHA256
1c5a9e66f21639e6ab33caf58b0dbe981268ad12b21a921bf55791c32ed739fc

SHA512
8043735aa735732792bd9810d249b41b3c58a479c87048ebfafb14d3adea7ba383e57120fd774e20cfc92c4707dfaf0a7d51b184dcc9c5f56818d6789a27af42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b22355b9bb32d8a48ab7c92d2ff36510

SHA1
91bbaf07eecb6e983389ab8bbb2c064591a6dc9e

SHA256
2e98aca98078fb1270f5d7058655bab83e4b0752fd41bd0d335f0c052386145d

SHA512
0e63054aa04e81ab55c8f2cb59c63b9d8b9fbc8c381dd9524397901a17f22ff09f87d5f18ec092f629a0e34cbeff8bf8cbf078d1703f44baa7a92a37749751b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
52dde98ad50312c2edb88d519a07f843

SHA1
5208431eafbaacf2c04ceab09a9198fec39d87b3

SHA256
52745d30a42dcd832128f63cfac068e4513a3cf88d91cb78b45d8db26eedfc65

SHA512
82d83f608804fb9c9f741dd10c121ce57c6621df717b99e6e0d0539995e665ecbf1a6d6c38852c90788d2f64afe7cc9cae3fa85e1103a98667f159116ad4ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
088e7a212cd127d718a28ad84211a896

SHA1
f8cf206ed77baa144f525641a23ed8f9b8b8700a

SHA256
e61180953bde8f5a4885e9dc74692d673e85943f3049103749d2be27355bfdc1

SHA512
c3cd940ca832e8a0041ffed20b29467d17cad99a98e30bde38aa76645e0ff4dc2b9216be55cad30a61a302b044ebb5156be1bc35a525b466f8e044ebb1c057e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d66ebcbc4b2308bf9b52fcfec263229

SHA1
c9db2fedeade8b96c835e5c77f2556950d52f395

SHA256
5515f8d21ab750c4d6ddd9be33c20b59d6f327d3a5f3775761611a7e474da25d

SHA512
170d1094d5180595a42c4384859c90e96c569e0652302dca4074b2f08bc9844dd8b2fa0888a707c5c51d5e23891d132ed5a2d30fd8d8127d184de5e9561faa3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e4160ccc30ac0322283cc6e7c5fc031c

SHA1
0704af9745a7033a82c8967bb2dba11c8c58ebcc

SHA256
66576119f7cc616dbda1c240ef0e7cccb91aa576f38d17c8d8490759947171ca

SHA512
aa124a7b982d99b63e36685b60b909428e0019046116747c1320a2c26d633fe2d40dde4e73d5b2c95fc462255c28ee3a1c1bd5ab9b54d2110a7769e8f98cfda3

Download Submit