hxxps://drive[.]google[.]com/file/d/1Ttlb0zvZenLDgTCc5RvtVHv8YvIegVli/view

Resubmissions

24-11-2024 19:36

241124-ybqwesvrhy 6

24-11-2024 19:33

241124-x9xwysvray 6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Ttlb0zvZenLDgTCc5RvtVHv8YvIegVli/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
12	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
4928	msedge.exe
4928	msedge.exe
4012	identity_helper.exe
4012	identity_helper.exe
6016	msedge.exe
6016	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 5036	4928	msedge.exe	83
PID 4928 wrote to memory of 5036	4928	msedge.exe	83
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 4432	4928	msedge.exe	84
PID 4928 wrote to memory of 2940	4928	msedge.exe	85
PID 4928 wrote to memory of 2940	4928	msedge.exe	85
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86
PID 4928 wrote to memory of 2712	4928	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1Ttlb0zvZenLDgTCc5RvtVHv8YvIegVli/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ee3846f8,0x7ff8ee384708,0x7ff8ee384718
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2119101017666547542,14213107047788015847,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6468 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
21cb6c9b579e24fc444a4349f4523bcf

SHA1
475a99caa08670f772af05dadc66a84c3e2dc273

SHA256
6f975295a72083c3c90ce3471d04bcd84cb31c25ee997e239912b7593cf918b3

SHA512
8d5128ef8104a7499e1b0aa683b00420cbe89715d7db7afd17f8aaa131bf94a7842c4009a40320e8e62fed78a4dfd95829ab240afe26a920990e8720b461ab4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
953d6ddbc5110305c0e2f843d9630250

SHA1
8ae99315a49024ad3fd3ba9e8a1b43d014cbb659

SHA256
d2402fb91134a16e6b14c8f51516aa25d8ec2c9559eecd3a89bc08a9e80c3eaf

SHA512
2bea2d0731d178462398a910d81ba070627c5aa89ff214d0db282ad25d4b424268e450b91b5d4c862e6e157687575630e8368bbff4d20cf6f6658190ed7f53a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6ae0b48b481ddd76d866f27f900593b6

SHA1
9cee313a5c3074a65a773e79e59701282e828a9b

SHA256
33fd395d737fdf9d4580c46ff3dfdd0fb4b9526e1d9b91e2ee7250c9f8d69821

SHA512
4a110ed40f52e21311e5a174f3a896364698dfd3a9164dfea9449b7a0920ba331df54d9ee3e6e6baaa2288d6d0ccb62cfa8dbb86ef051f23f11e2915d311d344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
99c80f9f60bea790e3e2a3504b7cf7ff

SHA1
60ab25bd4bc7e927c40f9900f2fa4650bdfdfef9

SHA256
b8f5ffdf434c3d987b2e201e4f87447df685d888037708ac384fb8d3ca7aabcf

SHA512
5ffe1ef1d5864864c670b23d4b3f733ad1c495c6f11c0cae6b5f0ecb62ecb8c39c0b4ab44b43559716344d5689b880deea0b55f494048e9c729a0dd344bb6eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29d8f9ed591a58273b027cec158790d9

SHA1
f5698f5eafa2c9efa79b5ab30068b607cf40f1f7

SHA256
1d280b904574bdfbdfa6e4919e4e856d5a951e3cdb6c077b2acd3f9669c1b337

SHA512
70903394651fbba79fb9c97747356f709e4d0a7dd683362f90c6a3e4c046dd356ce7364232f614eb9fdd8a54aba52c5d5e33312edd26a2a60319d2d7cf9e7ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12debbee6bd0cfbf6e3ee6395ab41e59

SHA1
29c1477b1c4a14ec456e4f5fc7df04f6dfc9af67

SHA256
9c95c177914690761d9c7b126a30803bb3167a98670abf6837551c914c215295

SHA512
748a98e8e8dc14c011d8617b4a4a003d72e5f63380ee30668bb1252fbb1f0f76efedd9fa840b7d4edc05f25740f757c56fa85cfca48db1735856752191a68207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b118f6ce065bd63993041e248310d4bf

SHA1
f0f6263eb68de3cd10868a62784a43717b929e86

SHA256
a3c3ec96fbe8e9b358734adf213b2b7a7390478bb48c353539af4f74c0062a9f

SHA512
8884eb031f7f8ae1779bba21b13b574bfd944a931a9c642274ee47928b19bdae0009ffe62a1fc5fc4cee503f1aebffe2ec3b3c56d3b5ed2891e6126aac3a888f

Download Submit