hxxps://drive[.]google[.]com/file/d/1ShBhKN5oVuVtCYG2E_ABGA0l6MlJ-V0L/edit

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1ShBhKN5oVuVtCYG2E_ABGA0l6MlJ-V0L/edit

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
972	msedge.exe
972	msedge.exe
4748	identity_helper.exe
4748	identity_helper.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1848	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1848	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1964	972	msedge.exe	82
PID 972 wrote to memory of 1964	972	msedge.exe	82
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 384	972	msedge.exe	83
PID 972 wrote to memory of 372	972	msedge.exe	84
PID 972 wrote to memory of 372	972	msedge.exe	84
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85
PID 972 wrote to memory of 2388	972	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1ShBhKN5oVuVtCYG2E_ABGA0l6MlJ-V0L/edit
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb55646f8,0x7ffcb5564708,0x7ffcb5564718
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3500391265314564165,11892013236174044168,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x534 0x530
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
8965651f1952175f2a4b39d9de07a839

SHA1
0fe9cf264625a35a2f4a280bec852e1542e34687

SHA256
3e2678b22a2a226c01f383db426e01cb9336e8941a788f303c6e7a7efa5ad7d1

SHA512
1aa572a6875106dfa84a67e2b38be3fb9c98830e0e2234427ea02749dc8194120b832a7a2aac0133f7edb851a3e2c70d80fd6d99b93cc4e0cc20fa0308a563ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
5fe0e0be4f51137029cdf7ac07153b71

SHA1
dcb48e89e424da34eca4749c6f9ee0664a51ad4b

SHA256
beb7a73d3f87fc95584d4e01b7185a1120468ff828171020e0663c859b5e54f0

SHA512
ff2781f7f3d6aa4451f1a2622e6a0d5b456215fadf6dd1985a244e6b6fc58ad1c578953e64cd192babe1484355139272b6ce49fe2a827c638f00b43909f9acc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0f78a778592e029a163311ade7699cf2

SHA1
c4259262e192cbab8299d19ac9a2aed1656e59fd

SHA256
65be2ae48f4d56d8a0f97ad40c955ace2a6c3368ed5181a1a4b5d410bc9ce178

SHA512
e512f4f413003b4613fd03b8e10199479265ae566d6cd67eb38e78aa21f8bf8da7180dc6c6ef67a4462b084e52f8be39f5e27398432a43caa565d603f46feefb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
096851ab5934c4071057135f51d95b38

SHA1
da307bd58dd253e3bf6f2e2d2605968876773dde

SHA256
fcae578c3af5cde0082242ae1d60cc4773f2dbf13975f6c18da4e4b919570fbf

SHA512
e1580202a54277553866518caaa0dad26caee0e5f0f8f0abeceed5640551cb89cf5fddcede30f62b6100b35f01bfcc1a5bf8aa20cab19144bcd34e5f3cbd70d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7bb8b47b13aabf3d686b8849b3d610ef

SHA1
0f4d23a7e487fd1234befb86767f8ec772e21e02

SHA256
87f6cdb92ff91670a1de2a0f6d2b2ef582e27d97000736b936d9e475dd299c24

SHA512
1d7056a5c519fbf688f8aaf441888ef26da6c0019e9a78988ee28b674ef3222632931a34edbc12a440c819d7ee704670f4f7ceacbdbacf02cabe160db1d6fc6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

Filesize
97B

MD5
d77105e4fc742db7ec5a8b17c61a821d

SHA1
df205d27f9771926fdebec6f399a32d391c7f620

SHA256
fb8f6319f7df9f4c99914e2e2e34b0bea05ca87b93e5a89a09dcf7edf3588fdb

SHA512
bde29dba61f6082405dcd5b109028d4aa3885d14b403d6c03342bf6c2cce95f6b58da959b07b24a302f25b4d0640405b570e2cfaaa288aa0ba65bb182c7ec108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

Filesize
33B

MD5
b0195b619cd45d0f8af48fc59c3d7716

SHA1
d153ae8be73da841309a68f26d26642d05ac20cc

SHA256
37bb3e6cd75d830156a6934fa1d1516121b37b4a220705fe32adece7b7ed927e

SHA512
6d917a97131baa380386bcf2c83dffb97f832e85f9510db3df4f7cdcc35396da58e5e098fbcf3fa7867b7909c09158d091ac0432919ca685ca5c7966b88a23c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7c886e17d56899fdfd0babd846ee7268

SHA1
d38b1e0206a413a1469ed77f18afe195eb7917df

SHA256
71edb51a1d738df150fe6e9bc61ce63b346c16ff2b9bb0598636ee1a449afe49

SHA512
ec910ba15daf450a3aba368419ad7f536fcf7e8bb869cee600ffd9110e395e46bc500484c9e19ac4f592d8e9ba6f1225c04154410b0532979659f9ef93029b33

Download Submit