hxxps://drive[.]google[.]com/file/d/1I06PuLVO13AqCrDpaZ25KiQZ7muky0Gc/view?usp=drive_link

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-08-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1I06PuLVO13AqCrDpaZ25KiQZ7muky0Gc/view?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
3788	msedge.exe
3788	msedge.exe
3632	identity_helper.exe
3632	identity_helper.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4792	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4792	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 932	3788	msedge.exe	84
PID 3788 wrote to memory of 932	3788	msedge.exe	84
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 4584	3788	msedge.exe	86
PID 3788 wrote to memory of 2268	3788	msedge.exe	87
PID 3788 wrote to memory of 2268	3788	msedge.exe	87
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88
PID 3788 wrote to memory of 1824	3788	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1I06PuLVO13AqCrDpaZ25KiQZ7muky0Gc/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf89b46f8,0x7ffdf89b4708,0x7ffdf89b4718
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2399690508011526665,5465412021564668566,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c 0x4e0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
929c6218271a6caa64d626243acd505e

SHA1
3ff1481fe60e32d1da737a8256016158033df11e

SHA256
47842bddee76f4db301881faf18b2121d91cc98a9b8d139c86bb793de7ca2e46

SHA512
afe5f8d6e68b0e083bb8aeb353981d9942568797e0bf84f77f65554797f21dbc89bde261ba676eb8efbf2bdec8eebe7512aceff8d814838c0db9863929831393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
9fcd1cf8113282fb95c006fab849326b

SHA1
3320bf0b97d91ecdbd2894c53f55d5cbbe79822a

SHA256
3fa55d4942b6a184d858227148dc93213d6dbb26b10705125c6c1ad14898da41

SHA512
8fcee5ce9cf0eacaec676cc9838e3da2cc52e49bbfad5ee5e019fb4f57df02e9e19fe6c3a34e4b49a9f124add49aabf9cf4cafdd47e5dc8a5048898a8209c5ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
32939cda40c0d1707f235f9658a4f2bf

SHA1
011f841dc35f8590121a99a2f0be95e7c3cb5974

SHA256
0793255f7c92f5ada59f78685e13654f4970de7651e3fb2830601802e1f562c9

SHA512
a89c1d7d5186e6ff8162a4a1fe9a7709377c1d98f13e3916ba08d76ec6f56a618f37f0e4c3bb8cdf0c8e58e2cae45ad2b2ba0a3d780bcb6e9aa76ce51f16d4b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e7bdc4a8a56b9f53bb2df4922ca14152

SHA1
0967bdda9a2e3b94d77240d7d6a7b4e0668dfefb

SHA256
b38b00aa260b6b4750d55c9453bb42989d9d9d9fc013745459f9a873b303acf9

SHA512
2af07ea6c734789b4f9253cfb4f5f3f90aa13e0b7b78315a9bf1ff3918d33b61ce28418cf3618fe6b27b1a3e626fcda08a7759c8742625e2dec4140980d48329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
572573335c28362826109f4786466a57

SHA1
f10b1c5eaeb5dedfb6b0fba7ca7f8bee74fca8e4

SHA256
df9dabc772ab4df72406e2683af930d7809de341a400307d181da8c0860204d7

SHA512
4a6b415e15edf3bcc4558fc530ce780aadaa1374c982c5444cfa33f97f4559a7ddc0966901e03660f4531a81a1254ee92f782a9ed9b57b9c9042b62ae3579b4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

Filesize
97B

MD5
74beb5b5c4cdbd836d085e3c43d85faf

SHA1
41333221a1be2463ea3972578b99b67b84dd52b8

SHA256
9d8e5639d9d9ed5d2dc750d8050a042ae248b60080e578828ce5fa01a45c718b

SHA512
7fb7c108e024f8145d642e739393bb5563ac53c17aee93628813fded8de3d1878c6fbfab14dc994436615dd4bb174d79745f4fa521b67c689922c70004c33b7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

Filesize
33B

MD5
b0195b619cd45d0f8af48fc59c3d7716

SHA1
d153ae8be73da841309a68f26d26642d05ac20cc

SHA256
37bb3e6cd75d830156a6934fa1d1516121b37b4a220705fe32adece7b7ed927e

SHA512
6d917a97131baa380386bcf2c83dffb97f832e85f9510db3df4f7cdcc35396da58e5e098fbcf3fa7867b7909c09158d091ac0432919ca685ca5c7966b88a23c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ec3a8a7a56dbcbe05ea49fc49f1ebb9

SHA1
6f99ad88e7f6cb720e00978870b2412b7e9df75c

SHA256
1e9711fe38e7de4a28d54f3d568c0b591b96c62318a6698e1ba0a59ef88a8422

SHA512
046a686fa9712ec61d9e155a375b260d95f79891b611ace10c6cf9ac7c133a8fe93ce12e0d5edd685471e0b964180e7abcc56e4203fc7cc326014d17789886d7

Download Submit