hxxps://drive[.]google[.]com/file/d/1WepAqepJlAM2bDiE4Xhv15hAVLgUtkd1/view

Analysis

max time kernel
584s
max time network
524s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1WepAqepJlAM2bDiE4Xhv15hAVLgUtkd1/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
212	msedge.exe
212	msedge.exe
2280	identity_helper.exe
2280	identity_helper.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 3128	212	msedge.exe	83
PID 212 wrote to memory of 3128	212	msedge.exe	83
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 2136	212	msedge.exe	84
PID 212 wrote to memory of 3972	212	msedge.exe	85
PID 212 wrote to memory of 3972	212	msedge.exe	85
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86
PID 212 wrote to memory of 5004	212	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1WepAqepJlAM2bDiE4Xhv15hAVLgUtkd1/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdac5c46f8,0x7ffdac5c4708,0x7ffdac5c4718
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1780,11288911282660542878,13842859037973518904,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
d5a40396cb514538b5dfb54123ba1bdf

SHA1
5a978646abe944a2a125b458a3ded37fd4f4015b

SHA256
f8cbd80b3582d05275a037da58b3caeed7613e51f21d3a2e4c3c226a8a768fba

SHA512
78bce76f4211288e4f70cc3217f7a5d8a08762ea1d0d02b75bcf600b6d151e400ac74e1b32b60198c5d310a3d3d9f8065075afe81065653163dc6bfd41e573b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7975237122a66457d2b4e668f1156e1f

SHA1
093ec6a4fd16181714c4dc75409b91c40b806146

SHA256
cfa0c59ade9565d0a5910bb49349bfcbfc3e37933789da52e2c3ef76d622dd04

SHA512
92934600d289dda2cba5c34fd9a87b54286e9c173eaef5c2959147f1c9f37424be879eab81682dff2335fd8b05ba19e8633549b1d4da32e812b803cda25eab8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f9600d20485d5c743fa09728b3c24c87

SHA1
2888a7914dc9ac32dff2d0dbc89edf3a011d0364

SHA256
248c670418ac8fe5e4aa008c11d012f7a544595587af17e88f9daba8f74eeb91

SHA512
a243f442976c7be0595f34fdb4a9ffdbce50a9504d675c33a531e80c07e7a4ed939c359508544e07ae4b20ef89bd330d1a98dba2efab8b4193d99ea234318bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c0aa7cfa4b5a7b15e2e78c4398257903

SHA1
bb1c9e2ac3adc380a2b04cdaf0a037efb5b4d021

SHA256
6f975cbe1fa175cae3f5ad7f8c8fb582a91a1e1803765f8562cb95c15bc258ab

SHA512
2917a21f250f770a02bc85cfbbc01918da4aeaa98dfa712b8d5192dacaba43e96ca5817dd43c7ec92e5b31d04b1e9ab659f2b7e9b2c8ef54cd288541c0f07d9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ab88314a5199bdf3b4c3315dc2bf8f24

SHA1
264580e4b46cd69cd004bad0b11898c7de5bd392

SHA256
ea5adeb22f6e71040f9eef52bddaf36e9d5eab410104f7506e0353f5788a7d86

SHA512
f24bcb97dc5cd5a54562f17e69cf70d426134d7cfb62939c08f2401ab46d3ff629559998189cf50656fbd908e6548322e863e4843cd8149e5e8068528b5f93e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e8ff9225a53ea56ad42fd5e58198e936

SHA1
04b3633d3227afa595d2b60c4fe626c0ae7ea7d1

SHA256
82d3236b34c55933e70cd4cb3529892e55e7fff4703452a40a29ec06b0a8c462

SHA512
d29f0755cb61b04177da29f5c39003b2baa658146366044529f2483220953e558ece2da22073472693abbd072cf0821005ce2f579bf94f86f9f56e3ae79f1a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
184abcb999e950b0f0bdc229368b1efc

SHA1
8c5e2ba49b3aaaf4b9c3d5c57d8061920d1daa36

SHA256
ffab49d577752007b635efc5a72a378c4a6b670b4452de86ec0b2028bcd8b357

SHA512
190d5dad5c9d6606eafca70416215c2ef5e6f768c4a6c7d83b896fd9d48d0f09d26c3def3deb9c4e3c3cb688e26e98c9c092411334e32a744958d795e32c2abe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a1fb1f086b45dbd745be55bc926f7123

SHA1
ecbbea9ee7ff404393c2c2a69d8447dfa463b1e7

SHA256
4d6db0d2634e6b4a42ce7c825e563298d00ebbbc72b8e91c48f34fccf1c62d54

SHA512
5dd08cd0c643e9a6eb17c93926aea02a21ce69988d17415f505d09f1ab0226d869ac526a2c51c1a9d61f8a29514758500acc08f56db5ac328accc234af787670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f97d060726f5868e3827bf8f5c1d735

SHA1
55e512dbda132ad75a914819fd2b2c59c0711329

SHA256
3e9bf9dc894cc8a5b7107cd19de291e0a54b78866b369651b80f4c88ccb5c2da

SHA512
dcf01bbffd71255716a40f1a10d68557f3c50618ef004ebd33666d1dcfdb7b852ee1a05f6a72c4c33cb834c7943da50038492836e62ad95fe407d91b175b2443

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78075e822710304479e9f798a6de3d43

SHA1
f20bf0f44feb2febcb9ff805939ee6fc897aee5a

SHA256
c5380e70c89be9db9e71489e4452af78acba8255e774d86c2a0bad2dc9241378

SHA512
bbc82fa34ea3764e64833230aac29d532338d02ebca5c2f6875d126cedc2f615613857991c33c7e1b94ace1d794f127821d28247c6f3d7e245a715d301e66f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aadcb03850b1a81fdb3a00ac45ee43ab

SHA1
a686720da8abafd7eb9e87c437c29b515e666902

SHA256
61a08d08d6e9fe2b2056f8d3a51e9e81a14d261bdd397be637df719d428caea6

SHA512
1fc71bda744806a509d98888a8ab25c54d2c3209539076dfd99c99f640cc3c120b08492b9cfb257a24efc3afaa15adce9aa86c71a4e151a6cf9aeba314e96318

Download Submit