hxxps://drive[.]google[.]com/file/d/15ps7HmCHZzK8PjZVbzguzaKrZ0mHzpuI/view?usp=sharing

Analysis

max time kernel
522s
max time network
523s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/15ps7HmCHZzK8PjZVbzguzaKrZ0mHzpuI/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
1956	msedge.exe
1956	msedge.exe
2860	identity_helper.exe
2860	identity_helper.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3560	1956	msedge.exe	83
PID 1956 wrote to memory of 3560	1956	msedge.exe	83
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 3636	1956	msedge.exe	84
PID 1956 wrote to memory of 2480	1956	msedge.exe	85
PID 1956 wrote to memory of 2480	1956	msedge.exe	85
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86
PID 1956 wrote to memory of 4616	1956	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/15ps7HmCHZzK8PjZVbzguzaKrZ0mHzpuI/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabf6646f8,0x7ffabf664708,0x7ffabf664718
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1458976528231901565,2618169047299166821,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4423f267-bd14-4aff-a377-84d57ee02dc9.tmp

Filesize
5KB

MD5
a6b6474209fff119bde10c5978930bf1

SHA1
962879eed2037ce95b11480725a296bb2ac95c19

SHA256
3ff4dcc78686128e2872a4f35e5b0e1813ce8da2aa09ee81741f4a808bb535e4

SHA512
78c735e25647f9daf3782026e92229dc52a58ce76c2c287022588f9e1f8d3f1bd17aec7a11e399c2b4c01c1be05000ae1d462e77c25aecfa520dcab8098c4e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
ab45cd66a1fadd602ce6afed8c249bdd

SHA1
916828868d32f03a7f37fc90202a172191495ef6

SHA256
3a86a7c2a09d974813215d05158919e84abaca396fad894d949f3e964297c68f

SHA512
9f1950ccedde02286135308d8b6e6ad60dd8b23cbef5709c18b9aea5b070bdfa1b4052c8797f6b2ecff121309b02fb685d5e294785b029d255c2469167a5bf03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fd1c3fb475516b39e578d79203c6713a

SHA1
06401e4dca4cd4213641260ea6670c87de13d30d

SHA256
0adbbd837e11f17cefb05711c1e917ca9c817fbc3bc79d2b1d046212c82cc9d7

SHA512
823ba6ce3c98af6b16eb8cb452410f3a9629357601affe56d0009cc9d0dbd5fc9e0799a0aff78d0a38f1d94fe08864d1cb3c6b594c9dae2aae0f78fcf681fead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e416994331d07c768903421c658b3536

SHA1
2247f62636d625363aa703ae92fc86828b5a9097

SHA256
af5aa8d7d94b86d6adf9e5b19e13873f2e87fc58545269ae4fda84edc86f0052

SHA512
c2e7b8165a8ca19671c4e547d0782d0596839964bc0bc846670b60672ba8791450cdc8b1f7e882732ae834e4daca36a8e52a2c0d9b77cd65bf8f930c49420970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
330e56e5d70bd6e81d2d7c962da41262

SHA1
07d5f9517a3a30035195861a15c275b59ab5c6e3

SHA256
f34dda3c71425fd53864d5d4c162826029ffda6d739dd150e1a83300744688c9

SHA512
a2a2a7034fa24637f1d731e87649ed54ccd993a2f43c21b150a39c6743088594d089f3b758b2e1d4c53aabb5ad87034ccbd6df88d5f9c901dcdc91711d1b1426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f0dfd462c94756fe54704fed39664966

SHA1
a91b80742bc579aac4f763f41acbeb34968144f0

SHA256
9bd34d00c23960607b315bd25a986f4c225bc9a5d1713497172015a49dd566ff

SHA512
31da6a8760b0863dd8671bbf4f0f9e6d975df188f3f592ed921032ab6190668522bd3e1462f8ea10c7a29941089394081a939d93f9f44f1161369c5247b01ed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4dbbc9b719b8fd3d5723c217ac62728d

SHA1
bbcd8c32482285013de7975190b248c62d97d5dc

SHA256
c9a5cf7b0ba6f7b1912db49dd9f9b3d23d38c9dfd390a6ff01c18509aff4efef

SHA512
110308b571260dabf4448284891641fa97d70677694a3cc20641a101c66dbe8a4af317f3eabdbbbffaeee3a42c646f7848632d03a5b6195d7727245e5d355577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
32156816db407af7d5483430268486da

SHA1
17c36c39d4de88e84705c29665d9841791cf2b7f

SHA256
bcc9bb8193494fb57cc06598e987750665b933bde0be5a57de05683cba0b5967

SHA512
74ba1678b017a1548665514e6bacaaaee53633d6fa3fabc21c5c6c802b963166c2db004e3f04733700543fc637aa5c40ee0405cc309ff2754e8021fa7e831644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebba71604c72f96191ff1f13d97d56d7

SHA1
b6180675c3659b0ca81e1d117db82e68f6490298

SHA256
9a8f3c90a4c3be4a70e151aa09d4d0fcac60cb9b69f37a392cc57ddda237585f

SHA512
92d02377956cdae9ec52b19628ac96c24cb3ff36b4246dde3c74ac2c9aa55fc7b0e4b2cb64891f3a4f10e55e0c1687badf5f53aa54b686d1c434ecee2a0f14a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f69bad6357752f3c49afa5829c6a6d0c

SHA1
ad9374f7e376bd46ff3d13ffc273d68c5e2ae893

SHA256
5991d0fe422684c0917e91c612993186cb6748f120aec7445bd4188e04263016

SHA512
99efe3af27279a9f500bfd025c5349ac3428687f933fbeb6844d7d62818985ab85ba4d34f13a0485b9362ce3dc456d32d7e0eb41c077b0852d2c711284473472

Download Submit