hxxps://drive[.]google[.]com/file/d/1XaIFNpsQ95GcqlGUz9WzIs4VoUlwv2u_/view

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1XaIFNpsQ95GcqlGUz9WzIs4VoUlwv2u_/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2964	msedge.exe
2964	msedge.exe
3984	identity_helper.exe
3984	identity_helper.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1640	2964	msedge.exe	84
PID 2964 wrote to memory of 1640	2964	msedge.exe	84
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 1916	2964	msedge.exe	85
PID 2964 wrote to memory of 2388	2964	msedge.exe	86
PID 2964 wrote to memory of 2388	2964	msedge.exe	86
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87
PID 2964 wrote to memory of 2136	2964	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1XaIFNpsQ95GcqlGUz9WzIs4VoUlwv2u_/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1fe846f8,0x7ffe1fe84708,0x7ffe1fe84718
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16782192619759472739,10387269133772066459,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f052ebe-7240-4372-a70e-146be3925c4c.tmp

Filesize
3KB

MD5
dec13651d7e77b2f8d5057422886cd3d

SHA1
4946c709c798aed4020ac162b81706386cd94f83

SHA256
f90c2e79aa16261fe444128ce1a2db6265f46103af5fb30f3f635f5c0e9cb364

SHA512
5abf0d5374243cfb35dc97d25ddd24ecdc7ee11a92ba0cfd479fabdf8c0310e008e4f1d291d45e22fc5db3835e1f0274768651eccc848135d90819769ca63862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
4e15ec61449c0ea7bbadb5b9a0263235

SHA1
d0fe13c32cebd42313c01a20999f49b909a9f4e5

SHA256
7bb07759a882112b9b80bda93c33532c626a95658b4e5ff3540332b2b069c8c8

SHA512
6f25c96f4900f7018c19c0204d8d06014e760ecc5873f2af91d944bff06032b0a1437e96f91a735997aadcd3bb66d2e83931cb0648c08675a91f849fbeff0e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
190dd63d60a32b679ef758dbcb9d3e5e

SHA1
4fc1c8e32879fe7a5d4ee17e290af45bb3fdf332

SHA256
d55bb011c5ff97d6a02346068a561850945f82dade9d741f343d1823866baa88

SHA512
911838d6ffaf5b28aad640abfc5acfde7954f8b75c2cbe42ccf319d2b176e8dc178237161b6da6d2d1a3b12384ff4cb139cf99434f41543dcc94f3ee970df559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe9d518e896a81d6ecd021e1e48cc2d9

SHA1
f76e83cee5ff0830beda73934900d457cd72a65d

SHA256
fc95ace27d0c064e8f665fd3b3040ac0ee838fd43c27c7fb4a2413aca7e08fe0

SHA512
3757a719a2f6d4519e41e2b9fc0784131ff0f7f3e4374e0fc8a3535a8916f343172ac7436e7ea438f2e628d5490be62c7905b10e9f9c0cdb91093868ac7c1b18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d10a892767d211997fee53fcd88e3b4c

SHA1
8cb81be461789e1f395dbade3f254ef0adeb5025

SHA256
51b9cd64c1fde96e3cfae003ee36e2ed40efdf569699b100674fa0c83f7185bf

SHA512
16556627155b5c378ea68dc99cefe15fb4bed04ff33d0b6f06c64881fa289a55b8e2892598f43bb57fa783dc539d57f773820443f871a28bd2264cfdb5c3380c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
338b92e1ab4651472d3e58a1be9a9a29

SHA1
aabfe3c4b9b2f3f089d1f36669b01ecb28f7b287

SHA256
1937673ae9b394dcc3f25b1129cdd84eff067c950a413e49ef3a297bff9fc454

SHA512
48a5ee66c21b20d8894027c8519671f7c5cd7a1d405c770e626d1f08137aee660e616db29797a84c7a90d602b0c9619b8e84234fe8af46e51f67254157d55036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c3dfc24c26a0d9663b0fa3349bf8115e

SHA1
62757a9c354c2a934f100b38167bdfef95158a62

SHA256
0b1d3e5dd8ada73e5c426e64dcd8ce1a174a038cc9404e14141c23972c096fce

SHA512
84a5603b47a12fd7e96e77b9cff6335557a0581a8156be34bd734bdcb304bfacb62e4922e769bec801dc25ee604166083a1c6038f7e3eb4f04c1ed68e3989c92

Download Submit