hxxps://drive[.]google[.]com/open?id=1OLUfLDYzo_GDkxS9bx7GxCrRrfUXIiMQ

Analysis

max time kernel
145s
max time network
151s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
12-02-2025 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/open?id=1OLUfLDYzo_GDkxS9bx7GxCrRrfUXIiMQ

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
62	3456	Process not Found

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1496	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
3328	msedge.exe
3328	msedge.exe
2528	identity_helper.exe
2528	identity_helper.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 1912	3328	msedge.exe	84
PID 3328 wrote to memory of 1912	3328	msedge.exe	84
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 324	3328	msedge.exe	85
PID 3328 wrote to memory of 4724	3328	msedge.exe	86
PID 3328 wrote to memory of 4724	3328	msedge.exe	86
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87
PID 3328 wrote to memory of 5116	3328	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/open?id=1OLUfLDYzo_GDkxS9bx7GxCrRrfUXIiMQ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa3d3746f8,0x7ffa3d374708,0x7ffa3d374718
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11781065545074838181,5644812556546650918,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1740

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0YxMDlDMzQtODgyMi00QTMwLUE4RDAtNjMzNjM0QkZGN0U3fSIgdXNlcmlkPSJ7N0U1OUM4NjItNUNGOC00Qjc2LUIzN0MtMDM5OEMyOEZDQzRGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RUEzNkEwMjYtQ0Q5Qi00OUIxLUJBNTAtMzA2ODA2MDYyNzYxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzM5MjcwOTQwIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM3NDE5ODQwNzIwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ0NDEwNTIyMyIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78b6ce61b693206e26cf97ff7d664718

SHA1
e910df12cd3267c1f7b85de29acf8db6a789e847

SHA256
fdb53a106aabf9b5d083f81e9063c5c773596c02eb5beacfc9cf3dd9d36c8d96

SHA512
07118c04e895fa25dad63cd11100f50c17b469b7acb404cda7093e6c7131983381c7248fdbb55f565ca23ca5418132891363b579a1330ee2b4a02a4c4985d85b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
782B

MD5
c11f41a75965b7651913d4fa9662eb82

SHA1
3199840fce95013b6cef922adb19d50cfb58c15d

SHA256
0eef1ec92dcde05f52521d5b6d8ad5d41c5c0b0152f1401ecae6ba70ceeb37a1

SHA512
f806bbdd7fe281adec2d576356a474dd9b97f704419928a959750d5ba4c0656c320d9ca726f72962c1c46e392850ac90e60772fbed99d6bbae3b588e628efcc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3ea4541d0ebe6e7c942e58d50e36ed8c

SHA1
7ae7ca6ad76fe2e1883a0c0c77ffe716ece1147c

SHA256
9279ea943ced03dc0f93d271c405f83c7d7096fe4644aab78e9eeb6f7a8adb49

SHA512
df24794bd6b6e1c747795d296f702d6382249cc3fcc23c6e489c661ec4d660adf4a94fffa02afd69c1fa274842e9f8906b40e754e5f4a8b2ad1e9b4479bf7063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9e193c3f514e962320aec5fe5ae96d91

SHA1
8699bbbef7ca48f672517a0164f0b4926a515c20

SHA256
fc9d726b42534691fb2d0f03ba0bbd3aa4851dccf598240517d2b1942824212d

SHA512
c1b04c0db41060c31195fe98d1cbb9ba0707994e67f1bd954156de0d16dd02073df4136cac0939ae9a5d1b7442997fcff4100846f6c82c43365680c552337fe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7db9693cf6aeaffe8a1e29add7b3bb52

SHA1
e015dfa440ce09ffd2b85cf39877776a11c44bde

SHA256
40799443919dfa525146cd899d722b3850c976d8014ef3dc1ebf886fa1f8ecd6

SHA512
b0236a3a96d323e284a95804676c7194ee4c8e2bb1567d33204c1bc9761ee60f5fa1c04a6f6e1a1765cfda38e80e878894e4d1e37f32d5cdbd86b425a1f8a282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7832ed0a266dbb2570eff4e337b8020e

SHA1
53947d8a9a2086893cd2a39cbfe240801c002987

SHA256
512e7af7f26bf99e3ec1afbfb7fa3fefd8a6b0e4207f278450ed3c9a5e8964c0

SHA512
a3d51b0b9fe96e707bdef0656b7ba716855b2daff5ad85986b5341524abf2a79f57cf8021b6a22467b0810d9c3d06a62cca2605b104ce70363cccad5abd71726

Download Submit