hxxps://drive[.]google[.]com/file/d/1-Fr4BsFm0ZSqaOSWrCB9xqxqhkmlb7sD/view?usp=drive_web

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1-Fr4BsFm0ZSqaOSWrCB9xqxqhkmlb7sD/view?usp=drive_web

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
1704	msedge.exe
1704	msedge.exe
3352	identity_helper.exe
3352	identity_helper.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2788	1704	msedge.exe	82
PID 1704 wrote to memory of 2788	1704	msedge.exe	82
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 4744	1704	msedge.exe	83
PID 1704 wrote to memory of 452	1704	msedge.exe	84
PID 1704 wrote to memory of 452	1704	msedge.exe	84
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85
PID 1704 wrote to memory of 1504	1704	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1-Fr4BsFm0ZSqaOSWrCB9xqxqhkmlb7sD/view?usp=drive_web
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff866c646f8,0x7ff866c64708,0x7ff866c64718
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6518298124569733780,6850265209243763741,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8462281f-7a84-4c66-97cf-320f2b469e2d.tmp

Filesize
5KB

MD5
ff0e3831b05ff24f9d5564f5dcdda2fb

SHA1
defa38e552be91c491230d6a64ce72c92bf84314

SHA256
3c7f9a5cc950a166e40acffd3525bd6ecca95fdcc1d796f4a074e9135b8797b1

SHA512
857e467c43fe5c37f57f01e88c5cb1d7638273303a18a5a616fe53b08eae78a8713d9fba73534e9b57e7d6f352173d51cb4bac69be06edc63a44638796a8c3c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
24KB

MD5
2b77b2c0394bfd2a458452006e617f96

SHA1
11eff89a8e3e64401818f81a02bdc84e8ecc4325

SHA256
c46f001852fd8e16bb731f21cadcfa0cda8e7d064e11b0faa18d6bb8325acb1f

SHA512
21dd89b9d6874539477e8b8dc8d98877c86595a8b0b8deb624547c3f407fb41550f65ff744c22f25c574994414a28e73f4d0794c5bd49be890fdac7906f0ba30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
904c7904442f21c80a70b6378b40cc81

SHA1
233c1d49b128b49974f12c9414a25a6b8a9c7298

SHA256
f843a31acdf8b4858f519f295b9ae029113760106461699a1d1541fc04232c38

SHA512
c6b02e04eda1b18578c4c795b595dbfd914c95359d98ccac7fe59f74d3c03b24fbc6b4a306f4831843890507f24aa28360c6ec8db610f722916efdd0ee76b7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9ce357a02ce84162e393fb90565a4e58

SHA1
f1c4ea6b217b25f7c52d3556b90c816427249111

SHA256
188db006ee2a9a5178ed01e7d64943a500b41cc8c9c5273a33f0c438ddc50766

SHA512
2a90f1eb1c8c8f8a4755d6487b77ae27bb0af55f70f7d8d9794b97057b649bb4d88a3788c1d23e5d0ac3b058c48e7e781378cb65ed4b43fad43392b88e5b6c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c079a2aa326d68b7240c8cf6b5727d01

SHA1
5d7f28c0ea28da6779e04939d31a74e94b4b32cd

SHA256
51d44916115538494ac87d3c12e593f3bee999d3e6f26beba1d8b65f4c13aee6

SHA512
f00d4e825deb5d694a51460891af6444f05e525d25cece823c5c6ee22d9d664d81608a1d8ad4ed059781b4a2143b2dc95160e8c87eb3fa71a6a145e6113d2932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b02641427a35b4dba0dc29900b5018c

SHA1
23760b4bacd1a5dc586fd6d5816fc6a9475b822e

SHA256
b8288836c84b2946f1188d4af81d7a4c1ac77ae78a08ac90e284b5f5ea8868c6

SHA512
1f711f345a418951cc3371c8278be0786b44229d17344696dc33502bd8ca6f1327e2291dd7ccea62cadfbbe0d99fbda1f07738f9d7347d537c02ddbdb55749d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fcb45657e037ad2740516991cebb9b41

SHA1
5a77d9faa6f026be2236aaa6fda645706647ae50

SHA256
3da44d8195922af511e81e49bd05643e0862d780a201e9c2c4657bd9533bc1cc

SHA512
bad602f886d1e6b86794d24b97b2d5eafe6dd2dea9c6c4ec3c975f83d1e33c31a0a29d0ecccadc99eda3697d58022cdbb55ce5006cbc000ac2ce37a4f78cf6b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584939.TMP

Filesize
1KB

MD5
26cdfc6682e99c733e4c829ef86716b6

SHA1
ebb68153934a044f5a98c6870f6556cfdb6f4d7a

SHA256
6eec2084c3e446538f6a3ba61046b44601ffb1f6ee644be997220f44e67499d0

SHA512
8f8e8ec00009cf697cb9e81a4e3e6f1533167712f4f9025a3303eb9a4b615a3834c305708ab5e04afe180b4c084eb47dd78ce78f470830272bca33cce3dcd348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fc8014ac-daad-4bc3-bcc0-de593ddbf894.tmp

Filesize
1KB

MD5
40e2e47c70555ef952ada51885fd9aab

SHA1
028c2ba9959dd6279a93cbf8bf621e63801b2213

SHA256
4afb3ccebe18c53ad324f7328a352d00a039bad56a5ebfaa545a36f04d440d0c

SHA512
fc1540b8bdbb13625537c2b8b07d4ee28ecf9aa6ffc28a6e1a13363d0e1875fc944c6786919b779ec4fc0656bdf2b6aa139aa97e2b83c5ca6782ea2fdb3f6033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8093eb33cd4909a3d0e6a2001b21ecfa

SHA1
bb23d6917ead16ccc81e525e99ac4493852aa259

SHA256
32e013beac9a62a22ba34097d4683f112e4bc0eb8e2325ef95c613e21a219b22

SHA512
cd6d05334fa93db4db40fd155e288cd23ecb736f9faabe5ba9cd53439a799a830ae1232b53805c61217796dfdfbd93b922a7dfd2a65f2f32c6db683062d1c424

Download Submit