hxxps://drive[.]google[.]com/file/d/1Z5olMf9RJniepgVI8SqK6AnAxDq-F-by/view?usp=sharing

Analysis

max time kernel
600s
max time network
527s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2024 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Z5olMf9RJniepgVI8SqK6AnAxDq-F-by/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
6	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2772	msedge.exe
2772	msedge.exe
4496	identity_helper.exe
4496	identity_helper.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4884	2772	msedge.exe	83
PID 2772 wrote to memory of 4884	2772	msedge.exe	83
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 1580	2772	msedge.exe	84
PID 2772 wrote to memory of 2432	2772	msedge.exe	85
PID 2772 wrote to memory of 2432	2772	msedge.exe	85
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86
PID 2772 wrote to memory of 1088	2772	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Z5olMf9RJniepgVI8SqK6AnAxDq-F-by/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90a0446f8,0x7ff90a044708,0x7ff90a044718
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,8743769248939914648,3927008958726191220,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
0acea3eca23dc8243a6ce3cc76f9d69e

SHA1
c0daf2b3590d603ad2ce484b3a227716e3a57460

SHA256
4801e0cfdb2abca026e2c38a303afdbd6fe76949f2ad6bf89fd492a34ba99f99

SHA512
9c7c75a9a32633387290ea4b2972eec806d6a16e8900c3ce16b7d8884e35985c02213225bf16fc6806e189345bfb44278fa29d09f946e9eb1994771267d45a4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8272d9a989e36982cef904dc61858e6c

SHA1
35627a83b45bbad71a93817457139c9515ccd7de

SHA256
2b78d46176cee1c9bb2f04c5e7c7d3dab36cffcd77a5da18788fae4686466d60

SHA512
37462c302313c3864b49791239859ebbc8139549bd5aacacccfd746c43158c711ae85dd39e21cbe98ad4cb90a837bdb6cfb3a6003d9438ef6a8d6a65127a1904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5cfd4682066117a92f5aafe2b7dca679

SHA1
0f7a3005796c55f56d5264dd7f1377a4a45914e7

SHA256
f9921a1cd5723347ff72b613ce3a21c2b1bf812230cb8df314cc71d6c8a49f75

SHA512
2e4aaf69b39e4e6ff6c90c5df4d53b7e4bdc8f0f89bdd687608dbc13be5af6141c06755dd5bc4ec13b3183d2ac3ed5c4a51e564728b19760fa4c9784cecbbdc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c36b0b784f7d249886b994a382e2b917

SHA1
0ba4c1706bd8d71ccb09839fd74bd69a46596008

SHA256
4db9df7dbc79dc116150ea1f4cee3f0fd9c2c256425c5baa60d72b6e0dbff9ff

SHA512
553ab4b1307c14875870766f0e51a1478c60cbde1f5837ae465f660dafbff87b9ee2878a2c15e37e579604280ff10e3cd010ab33071c8a1d34edfe4db7a8df8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
76c1c8452dab95ba94de0cf647d09ac2

SHA1
1debbfa1e429fac751f6576fc10dc53180f5f941

SHA256
2d7f95dd47b4cecdcccdcc8e41e96b175a35bbbc5fd2367578bdc93887e01a44

SHA512
8918aa5d5b0040542480cc389c666dbeecc1758c69fc588aba03af3b5aa3a70ee4a45a3a697c86928b31e7ef8ac0fd48031796c8477c38a96e0f2ecd446fa9c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5e14e2ac0e041a775790b7b14fcad953

SHA1
b0554c931d3013b4203ee59ba819422b809cd05b

SHA256
cfecbf300b4a0fe0b02adbab68995d4de9b15874a2a21034ff0cb4fe21c52d50

SHA512
3a7153fc2c497c2b013dceb438374015af5640c298a4103f0fb81a28de003aeab8617a8d2f0e504d08a313e6754fa8ff21da67a4a236a9b1d04ded783d9e56d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3b077e98aa4f775d7628f2415347c1dd

SHA1
77477f0ba6a0e09628dbc7df2275dc9a5a5ba51f

SHA256
334221c946d5825ce2428fa3025a6e4f54d302db98a014e6497a982eaebfd231

SHA512
662cca978edd8c41f6d5f5a94f23098e83f77a7859795a607bc767f916da752e9bb775feede26911a94da84139e2cf4206725997a6590396860fcd8745426f63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8207fa327ce1ee8d04d9413659043dd

SHA1
47bfb646a7b75c3fbc52f079f5cf3d7bf25a2e2f

SHA256
cc5307d99bc62be8a7599d8b2cc7d53e88047aad4a3a916462c2354dfa14ef0b

SHA512
21ea59bd80da593babd701cd45211ae4bb5b7a2db45f19a3387a26d6f739936cf500bf3da3751ff1ed413e066dcc8ea6238f93fbd8cf45ca28a73308a9bc4116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a90d1d34a132e11e6b31c70c091ed61

SHA1
bf56922c9ffb861ead84a373e733ec3bcf5bb688

SHA256
4e546d1c00a1becb8db7ce3640f7a85614ecd32cd84b4febaad3c1ba9dcf7c60

SHA512
780d553131ba283410d9b01968a60791cc2cb62b124baeb2a30bb904397f1103ce60809928402433065eeb6bb64c882c95ec3279671b6a5d9ddbc52e7f56f906

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e805ea78d7b55408ee84d841e53b96d6

SHA1
79f1c1f76bfc425c3655a40177cdf869f039e9b1

SHA256
9a5c86103b6cc5094dc946ef6e7fd3f5f48097cb6bad954b830d26340dabb277

SHA512
a7b671a7a422a4611a6a598f3960858165146b091b982ace567218781555fc8b7122061529df989008bc47fb9a2f5c476566ec37be70e6630c39c58982f3b779

Download Submit