hxxps://drive[.]google[.]com/file/d/1D15FFGdgrzHGZcm4nL66_ONBxn9hIsib/view?usp=drive_link

Analysis

max time kernel
97s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1D15FFGdgrzHGZcm4nL66_ONBxn9hIsib/view?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
7	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
3212	msedge.exe
3212	msedge.exe
4464	identity_helper.exe
4464	identity_helper.exe
3284	msedge.exe
3284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 4004	3212	msedge.exe	83
PID 3212 wrote to memory of 4004	3212	msedge.exe	83
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 2140	3212	msedge.exe	84
PID 3212 wrote to memory of 1844	3212	msedge.exe	85
PID 3212 wrote to memory of 1844	3212	msedge.exe	85
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86
PID 3212 wrote to memory of 3468	3212	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1D15FFGdgrzHGZcm4nL66_ONBxn9hIsib/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe72da46f8,0x7ffe72da4708,0x7ffe72da4718
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,12840148549063505282,15449154920499812993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
c9da1602bacd31ad1654d9d9e42bb091

SHA1
2cbfa3e939df61b9cf914807092f923274fb849b

SHA256
0cbd9da8fe46a119988f993e4eeb567dbdefba81a8a39d7fb5834dcf8ae75532

SHA512
5812884eba682c30c740a0c8a89e33331c3a4990a5a6ff71a492ea2336e7911ebf4a9255bea1aa96d00afccb4c9da6e16a9a3ee831d5b0b8ab3ffad791c5e4f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a846d19c8f3eb43c55126da0fd8a62a1

SHA1
c03b3275174be809d66556ee8164af49fa2d1d2f

SHA256
bcb4ec934e89cd0389116fffaa0887ffc313c47396facb7a9020d71265dc9c9b

SHA512
b6d365a17e352f11ecb559bd4d8ca0d6222c91c63eec57136786a5ae3f9ad77c9f60d422068b2618bea50cca59509f6f07f0250481f7716cd9fe6b83106e890e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f90465c41103c650fbdd34d47991eef

SHA1
732c21f493b913bd6eed1de20dd045b663c394fe

SHA256
88280dfb311ee07a89aedab0993ddd86688f725de902a6e86e335da64d6a7e30

SHA512
80e1e746ae7b8230af052984ebd8ab9331f4da727c23ba39c562ddd2d4f41da3cbdc0f01b27ca4304c6cd4fac63e5518a9adc92567392f57dd88a9de54dab2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de5d8091a3f0e590fdd25831297fc658

SHA1
8b1316e2d753c47be65db17d6270a4594446ad8c

SHA256
9a8aeff924cdc2e962ed83807c9c6faec0258e044281094ee2a2ecdc3fc6f393

SHA512
e209f0423cc2c9b97e894a1581ebcb395761a3d24618a1c9953f468dc5d7a10728478ff0d1296f26d02f6e56344a58a469504761e5775f5ab6f97933eca071e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4511202ea96afdeea180553810942ad

SHA1
8611b59493789d84e5763c9d5cc8981a1e31cea8

SHA256
511773c4e55d45f765d072e3201c9c9fb9e3ed80e8956b92227e1681e94972ea

SHA512
70f9930fc06e1c4da91a6fdced0ff38c4aea474bb120d8211c8bb239720c01b2ad68a6de8c08872dc3bfbfe24507ca1fcbd00e0db73d12be925eaee25bfa8bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
710c08569363c12433936a75c7afed1f

SHA1
cc5754765df599b6aa26a9d4d7b905b090cea612

SHA256
9ea5821a1208f99820eeca72fd545b0187a048d62d205a19df57c8985672e097

SHA512
4730de6fa480fba20b4e44ff7cf1d2bf812899038412b5abde1a86b603b4d4e5cde594142f79e0c0e46d73f5006b5d31d7ee03298ab2b0171acb46ffb5c908c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d4a888e1f71d52ad81bb11c7b2f4014e

SHA1
421b65e43ac19809d26b7629f2f67eb36ae3940b

SHA256
97414ddf15b3e476065767e18523be40e532390dfff1e939bdfd78993a20fa30

SHA512
39d528f7296f38756f2e8602f91339a6216d12a30b2306ff47f77922be443d7a496143588cae5f66105ce97d10613fb5913ffa84dbd851c0e5ba4743be02d1c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
acc19a9ac5d3c828490490c498524e7f

SHA1
98a13abd0a4610db962f38a67944b4ceed582ad3

SHA256
59dfff1c67dff67768b0c76bcbbcd2d76d2af054682d99ac05a14bdfe61071db

SHA512
7213dc2c39ed17567efee9d853e250998765a8d9600228eb185cbd51067fd43523e535c409af1a95544ffe3a855f46a8fc6d2396fed981faac62d02892eea2bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9c023e87fdd9ceddb985fd798d03d44

SHA1
ea31179f910f1ae064e5637dbfdf23d2d0cc72c2

SHA256
e0c79ce5cd4e30f38c1b2f0f02676bda8ff79423597c59b02f6ed2964bee60d6

SHA512
c29198640f50e729caa9121218e0c7d16ec252b51767856e2767390cd51978aaa4d5378c1e27e44d02ad9589fa92f147e79b200759c27fb22bb566d073fae173

Download Submit