hxxps://drive[.]google[.]com/file/d/1tYocJ0R5lw3TvtyeYk5_brzwGi3ivV19/view?usp=drive_link

Analysis

max time kernel
524s
max time network
525s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1tYocJ0R5lw3TvtyeYk5_brzwGi3ivV19/view?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
3608	msedge.exe
3608	msedge.exe
1684	identity_helper.exe
1684	identity_helper.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4784	3608	msedge.exe	84
PID 3608 wrote to memory of 4784	3608	msedge.exe	84
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 2076	3608	msedge.exe	85
PID 3608 wrote to memory of 4920	3608	msedge.exe	86
PID 3608 wrote to memory of 4920	3608	msedge.exe	86
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87
PID 3608 wrote to memory of 1352	3608	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1tYocJ0R5lw3TvtyeYk5_brzwGi3ivV19/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8266946f8,0x7ff826694708,0x7ff826694718
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4841602058049312629,118627850742704373,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77910b2c-e2ce-4234-b809-9f3c65ed60fd.tmp

Filesize
3KB

MD5
959fbe5384ea541b20ef8b41bd7df7d6

SHA1
65edca5ea3c4eff6f83a1e6cb2dcdfd887bf47a1

SHA256
df438eaebdd818688e0cc9d244a02c2fbb9e70bea04e20b005cc4a67646fd414

SHA512
d2a22717914868c3c82bdbd11a801a9fdb0122e1006456c9b0288a0360f68cb5c71e472ce78f9c5b30726fccb39ced9802612f75fc9c3777fcb28d6448b79669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
e1675491f8c8052a9d5f507052dec8e2

SHA1
37ce7e967ea0a20974872d9acd0c310239251fc2

SHA256
980fe2037ba1aa2ded3bf25800778852f36a70c0431af6dc65ed99261e0a9022

SHA512
c289532aa7a2ad1248dddd0a04e48d917c67f44df5c363b072df489a0d8849156ed32abdfde70282508ea5c4fb656d0392cccda81cd7c87f4f612ca3acede471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7f53ca3e96609695dbad8d5fe276b499

SHA1
fe697908f0d05e9f26b71470b1643c00a0bcd2ec

SHA256
92c9cc2c42f95742755621fc6bdf5c8deaf7e0fe90eb2240f5276273c0dae8df

SHA512
06dcefc39733faea8eedd5dc5b46f8667701b5c64972187a12fd3597fbb6f18d33d84b200f02c8711e34db4e4f63515f391314db4da8b1e760955020c1a404fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f64e3519f3099e9217c6f18c63c2c836

SHA1
ff681315f87d4afcdeaefbec68d49071b8d25142

SHA256
3750b260a8608f01f80d93650b03548f6c94b7738f055e0e4c1c0484d3293516

SHA512
0791be566d4033819a9f217061a57f8a185f8787dabaa218b3c4fa3050bb1c7e70bff8c4ded1de56deb9fb73c7f6d7c2a63e1f372e3e60baf7f5765291773312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
99cdbc20dd787847f7656dfe8cf2d9d1

SHA1
5ed938fd0db4134ae20d08da5aa4c9977384d570

SHA256
1a9179ba27df753429853014daf35fddf8e639069e9924f9069ae9d2f72bf061

SHA512
b3b15ffcad2524d7c8d74f7f3778357e24645d02f29528df62da41a9c4a0b14a9a06f79245c641c2dc739da7d0f629205496cd0f450b07198a2e36f05195917e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0ba8aec21816a473fc5766640d23b713

SHA1
3dc4afbf33f8e41eaf4900e7ac2bcc43931b536a

SHA256
479b783569fad7c4d0aac48f3cbaa61c7ed0a337295fcb220a8714818a1a3dbf

SHA512
abed6614e639933cc92666b416e51ff44c9dcdea2eedf40c167ce6785028ccd824bfcdd154d42437ff9a7d866a8fda10557ad6749846c43bfb794b210918a2ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
93f7dbd4a7e9f54b914b1881df912181

SHA1
c2b3dea279ff47511b056f25a53dfc6efd601ffa

SHA256
0929c3004841fa8e2e3602fe5468f912198b84f2669cb04fc13826d98a4962ee

SHA512
aff55f13b91206e650179bbe2160cbd6465a729794fe46f4bfaa20e0a9d7dea4c1ffd5e557d727c80ba783884bef9e871ef99101881839a4d6fb370bb2416381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e5426ee5a397a93093b79368c3355097

SHA1
d34d39a93633814bd530607fda401f3e986f8496

SHA256
65d8935648c8d8a2947a1eddca312b24f20a0974c3009e1855957ea639d33e60

SHA512
80ab046490a2b34e331b3abb73aada95ae34cc0939ba9ce6ac9b2c6baee29d3652aa15a4bff7bbecb10d07fff0d60e74a6b403c611d9654d8dbf5a3397ba9c7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e9abd832880ddef61559ac86501a8d95

SHA1
f3327074fa4eb3e731fb5a0596b531358d8c3f71

SHA256
25d03c8622b2692b6ed0afdcabaf96ed2290b75056d7c463af96795d6848003b

SHA512
b873cfad39d217e1818812e44e5c063edaf85ee45f68530e1444abfd202e028b671792d21c667ac5af4ac4474fb248d7cfd56d85e8f9d905e931921b2fe333fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e49c491c9d72e18222ccf5b7a780e6e1

SHA1
ee977cb5788d1f38152f52a2657475dbc54222f2

SHA256
7d0ac60d530ce4a46f70ba85c5bfdb9829c3bd7c321ea00621b4a35afad8e19e

SHA512
b4b5c03e96b4c5039f8dd71bee8f40d03eaf290a58b682d5ee4372fbed142c1bfc260b2aad9dec5ec69e7814750468e976ca9680b64f46292558b989480db2c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1162e079b58af8900ea25b709cbff3dd

SHA1
4fee8ab3b93dc7739324e2c61dc6a4f1295be7c3

SHA256
51f0cb7dcd56560bbc1bbf34d9fede6254c15ac4a43106b6199124ac14c44eaf

SHA512
a0416a057ec52d36708962e9180761b35f357decb8bc7c75932048fb4b6614aa88ac2831c89202304f33616cd7a6510f2a478d2be2c5d916a6d6ec75aceaf830

Download Submit