hxxps://drive[.]google[.]com/file/d/1DBWjh3PlIKZAsjQ4A8bGsgsnw4HGhoqp/view?usp=drivesdk

Analysis

max time kernel
99s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1DBWjh3PlIKZAsjQ4A8bGsgsnw4HGhoqp/view?usp=drivesdk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6064	FIFA18.exe
6108	FIFA18.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 310256.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
1312	msedge.exe
1312	msedge.exe
3696	identity_helper.exe
3696	identity_helper.exe
5944	msedge.exe
5944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 3532	1312	msedge.exe	83
PID 1312 wrote to memory of 3532	1312	msedge.exe	83
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 3836	1312	msedge.exe	84
PID 1312 wrote to memory of 2688	1312	msedge.exe	85
PID 1312 wrote to memory of 2688	1312	msedge.exe	85
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86
PID 1312 wrote to memory of 2708	1312	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1DBWjh3PlIKZAsjQ4A8bGsgsnw4HGhoqp/view?usp=drivesdk
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f81e46f8,0x7ff8f81e4708,0x7ff8f81e4718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2256,6482201215844468065,422730872927678727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5944
- C:\Users\Admin\Downloads\FIFA18.exe
  "C:\Users\Admin\Downloads\FIFA18.exe"
  2⤵
  - Executes dropped EXE
  PID:6064
- C:\Users\Admin\Downloads\FIFA18.exe
  "C:\Users\Admin\Downloads\FIFA18.exe"
  2⤵
  - Executes dropped EXE
  PID:6108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
8a9d4282b3c614e215f732d0bf5f16c2

SHA1
ce967c68bf67e991cf63162d5bb76a827f6a1adb

SHA256
18ec101ba787fe905ac3ff491eced84c69971679b1835284a1fd86cdbdfe5dd2

SHA512
fe565374c75c9052db68c816572961ef5492b5420b06b483dfa5ff618bee2ed87d77943af906cf4059dd331cdb4d1260f00d19955529219213904efa3df95f70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ff0eaa9ba0d58ae7da970e63c70bd27b

SHA1
5a27dd026592e0f48e2182cadd7e33a181fc5e80

SHA256
370a518887c36fed588ca07142a4763dd06041cffe388f1ef51ac7e2ecc75c3a

SHA512
7568ff15b75307ccc40a5f0de9ed2a51aeeb85d724c471ff04f93d030788dbbef5635c49ff139605cccee03fd9127fd0bcf7273fa3bc214b20f969ea4c3c2c7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0e5a4379d6b9fa6a413c9141dec2dd0a

SHA1
d08bec7121a910472f71ff8bff9e8a3a0445600e

SHA256
bdfd8514728e9f9410411895dae7f0db4eab5e65bac5fdbf7551f4de5d637609

SHA512
dac31df0579b30900e29523fc34a71986cd01f767fb0f6c036a4d59dcb5212ccc75c123ffa734f2d2daaf68bbaa18193d6ac19862220af973fcc9b4be9d30377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c6c086d5f8a8a81f8c84456a04bb8e3

SHA1
7f109929b3bdb87892777285ad720a245471bc38

SHA256
2f746d6776a591146eff0de98cd2ac65737bae1f0973a900fbbf839664f304df

SHA512
1856855cfddf428e502d4e08c689a57cad49343d0596a49104e5776d144535506113432836a62dc097e1a7b226464bd6a1d3421b7039b4d5fec40642f5afe1dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
849b27037cdb4fe23ca8d7f39fa5aa2d

SHA1
edd1b2c36c216aea54461219d2a93eff6d7c30af

SHA256
56e2ba4bdc1f62aa4a52f3d0164acf515eca044ded5e8f147a35c3c7551a02a6

SHA512
e2eaaf7bfe3efce92195322706dcbf07171a295190e1a9381feac7362ce26ec3f8a4d5f2e707a469ef5e7b2661f7fa1d6250cdcfed81fb8503f542e891e30562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5cd5ce31f8550b83cb3105a0f3e8b9b4

SHA1
2cd2aa78ab9e54e741b12bd0e6345a0becace742

SHA256
2eebd9f743ecbfd4feb7559f31887898d3bfe221a1fbba41fb9246790bd32ace

SHA512
97972f308c3e1ac6e36278161f2c667fde5ed284d59f9abe405643e1c30423e995a373415b4e576f8d65eed0006fbcf1cfe090f65aa35abd3dc506898305f0f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b24f738011c4161ba1d74f4dfecb7127

SHA1
91e26edae3330004df9c44994a1ca948873cffbe

SHA256
c52f667a004e4d5ae05a150625191373ef688340c7d4f4f27a063ce37d30e491

SHA512
041513a4826269a49ba769a7a04e4204751bcbbb1d2d0263f5944d5a99654f4074d5721079368af0b4d9b7eba5b5f0f353f8344d1f83fe1d47233116f715243f

Download Submit