hxxps://drive[.]google[.]com/file/d/1uuseTvcRhyUUFumqFbNFJe1t6GxLtIE-/edit

Analysis

max time kernel
293s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2025 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1uuseTvcRhyUUFumqFbNFJe1t6GxLtIE-/edit

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
18	drive.google.com
20	drive.google.com
21	drive.google.com
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2164	msedge.exe
2164	msedge.exe
4232	identity_helper.exe
4232	identity_helper.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1240	2164	msedge.exe	84
PID 2164 wrote to memory of 1240	2164	msedge.exe	84
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 4008	2164	msedge.exe	85
PID 2164 wrote to memory of 2944	2164	msedge.exe	86
PID 2164 wrote to memory of 2944	2164	msedge.exe	86
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87
PID 2164 wrote to memory of 4392	2164	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1uuseTvcRhyUUFumqFbNFJe1t6GxLtIE-/edit
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff861dc46f8,0x7ff861dc4708,0x7ff861dc4718
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,14759246677114759553,12231023510208343578,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc29044ff79dd25458f32c381dc676af

SHA1
f4657c0bee9b865607ec3686b8d4f5d4c2c61cd7

SHA256
efe711204437661603d6e59765aba1654678f2093075c1eb2340dc5e80a1140f

SHA512
3d484f755d88c0485195b247230edb79c07cc0941dedbf2f34738ae4f80ba90595f5094c449b213c0c871ade6aff0a14d4acfe843186e2421ccbad221d34bf54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709e5bc1c62a5aa20abcf92d1a3ae51c

SHA1
71c8b6688cd83f8ba088d3d44d851c19ee9ccff6

SHA256
aa718e97104d2a4c68a9dad4aae806a22060702177f836403094f7ca7f0f8d4e

SHA512
b9fc809fbb95b29336e5102382295d71235b0e3a54828b40380958a7feaf27c6407461765680e1f61d88e2692e912f8ec677a66ff965854bea6afae69d99cf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
8c7d3bb4653b78643dba4bef2acfeac2

SHA1
e44d94bb1ed1eb82370ec9c4c3bcaf99cc11b6e4

SHA256
4de16a12a346bce85c6b94e40cbd56626aa0c88104a6ecd01b23a37f2b15b879

SHA512
a9259f13779f5a061bc843275dea736575fc7b4aed814d16bba86bbcb045827c3f92fc8506d04ca0919c845679bb3ada04774ec930335f6bc43de75f318cab8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
97ce93af13fb2ae53e464c3706c35e41

SHA1
3248372f23ff2562795f3274f5acdd403458c512

SHA256
736dd92a3b99a50ae4c2e171448ae426b18d84aa852fbcbe9437d9b570cf62ff

SHA512
995dc001dc99c2462a11b490300829d8d8584ef980da77e21652cb3859584b80a98171e34da6118c13a6550243713b3b81224273a15481f0a4d27dfd8133135a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
603e67c50c3003d185d5563c876a0ae1

SHA1
a868443b80d104b902177b300f3a5da06940f5e6

SHA256
8ef1c07e3f3b212d8b5a04c7963168fddca80b8c2f66ce0af6250ecef996eaef

SHA512
6aa6c81e3949582a31c5c40564f6666b6d340ab19c8144adca0f6786d232b92158de34cf1f74a8a36f283f5682c79ce876807dda5ad3029ba57a6bb690313575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e3f0646ddfd1f63e0ad71f500b242bd7

SHA1
18760555f40bc66cc59514022f9bfdea707f9246

SHA256
4db1ac3d678e451e8b2fb93fc029be862cc51a169090771dbc0630d3d21d500f

SHA512
303d55bdfd4bdc39001b2a2fb566f6c85af8bfeddf9a14fcc754b65f1cd9bf2e6ee33568582f178d9fff61312c367f9367d0dc7618678176ed6d08c18283d517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e9598643e1def527975fc2678ad03b5d

SHA1
174c60a057633e660776d1855ad3e0ab16aaddff

SHA256
f6e44c33c02299c1894f5f5212a3678e375cf34b3aa84494f779bb9db8b0ccb7

SHA512
5010e548bd40883b8bc4c4b7c360ae1f7ed9d149cb91d600117513be1e0e2256f0d414477691e3f752154d66fbeb6189017566c82c1025ca0358e662dfe97c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
644090e7757a59539f2c9271687d9d1b

SHA1
ff037b0f919f8a57be332c171719e96a8951481c

SHA256
58d83bafa8a4cbe38e59ae5c3216bf2bec7f847063165c1295457ee11d67e50d

SHA512
e29527cdcda6371ccd5f105ac07a0c2eaa023b94db24f238e33cb2e793586859104b7ae624df655cffba8eb58868f69320c57a3d845966b9a37754236e64a924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d98f57dd023a432659186b363698a619

SHA1
cf81be42d8c344164117867451382329e5d53f8d

SHA256
00bfc7918dd60672202f3363b9724dda15f164dd3fc5b68a29d5c555443064b1

SHA512
7863bb3a2342d9962d6d4863a06bd2984e5a0bdc7cf287e6eeaccfa66cc45a3d31ab13f0fe22430554369db170a439d2ac6e1c5330549daa4adbce0dfcb2eab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6fc5433f24785e83bbb216b50579540f

SHA1
20750aca6fe6e166abb0c63342188326196511de

SHA256
5ce4e83868610df63b5116c13d6dfe9401558d87b37baac4b2eda27ecf6e3608

SHA512
ba819535a23b0d0bbd24b64ff107fc6a6332fcf7ea5da168007088da7bf5a5ced6b5e48061054834768ea083214f8412455ff289a77fda2bde9d58e181fecedc

Download Submit