hxxp://drive[.]google[.]com/uc?export=download&id=1GwE0nIDKOsDHJwcHwzc5YmKVIGXP_MCz

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250211-en
resource tags

arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2025 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://drive.google.com/uc?export=download&id=1GwE0nIDKOsDHJwcHwzc5YmKVIGXP_MCz

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
59	3128	Process not Found

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3952	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
1236	msedge.exe
1236	msedge.exe
1596	identity_helper.exe
1596	identity_helper.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 796	1236	msedge.exe	87
PID 1236 wrote to memory of 796	1236	msedge.exe	87
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 3588	1236	msedge.exe	88
PID 1236 wrote to memory of 2884	1236	msedge.exe	89
PID 1236 wrote to memory of 2884	1236	msedge.exe	89
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90
PID 1236 wrote to memory of 832	1236	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://drive.google.com/uc?export=download&id=1GwE0nIDKOsDHJwcHwzc5YmKVIGXP_MCz
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6a2846f8,0x7fff6a284708,0x7fff6a284718
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13073858624621553266,15974442588151090713,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1664

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjExRTg3REItOEU3OS00MTlDLTg3Q0QtQTNCOUNBMDk0NEU0fSIgdXNlcmlkPSJ7MDE5NEMwNTQtRjA5OS00RTRDLUI2ODUtMzI5MkI1NjU5MEJGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OUI2MEE5MEQtRTdFMi00REFBLUFFQzUtRTEwMTcwNjUyNTg2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODIxNjkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1MzE4NTEwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzA0MTE5Mjc5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
801be0c9974f5b19e11410cdca27cef7

SHA1
31a5e111c6f20b94362d662d101cca5edb64b401

SHA256
9a89f5f26ff7dea0fd13726ed7d8e9dc9535288c75b25eaa6bc254324aa5e36e

SHA512
4bfb4783ca4f9e0affe002b2dbafc3f40e1e051cd5e8a787f6a926e467f307ee253c8a84a43b6882a2b1d11f8e17bdb02c4d74247a1e1716a65ab74df7fc1135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6393f79a5df6261cd25a71a1c7cf2a13

SHA1
881fc5e01962af69cd5cfb630a37f2e7da96e95c

SHA256
551698eed11cef04d0a7bf97ad2c84e78cd45d1e984d104c95b825959d9b9674

SHA512
f9f2b59ed4a20270213d3ce4883ada26edf911df2928fc6f6572812ef70103c61497a8ae4b75c4bcbd6048e90e329b4bf00d07b2d22b5a0c5fb67c9781373852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
795B

MD5
a3ea7de31627f25da436c054249403aa

SHA1
fff10755ea6d7e455b2bfdf2207ee805339514c3

SHA256
7175cd774bd25cd8be7774098961993b6eacfb4af727e70d02a4283bd394022e

SHA512
902cf728df5c0d933cbdf2406727994453555c2b0a2a7f857cc0aa50106457bd433e2f2e38297b203fab15a0c4e35732f8892d75d14b2aabbb0d4d8cb782c33a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5929af8a97a0ed2912baee2bf5fe8cb3

SHA1
6c9dc37d8eda9ba46a7f3740dab979323381b9d6

SHA256
8c02e050a266577a5364d985b1709e837bae5e50e4ae1812e7a5fbc44bbe78a5

SHA512
9f760fb6002d300ba1a25899d5f9341e6eb144d99f5af35581c54e655271250b65629495bfb3a3ef6b77c236b721b03fa006eab619e00f4bfb34350e92d915a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1aee5eb7eb067eb263bdff1d8fefe307

SHA1
39a221fa1f1135103869f26d4e12d88bc98c1439

SHA256
5ec5e70ec86c97f93d0ab5ba1c8f888379045b2a689096b95552e15d4d5af9f8

SHA512
898832c410572676d6dfe066610f920fe86d3d28aff5d2823a6f2e85205ca01e46a77b22ecead5a526f49840ec21dc7600a7f19cfe41e910b02bed10e85e0bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a2002ac8-a9f1-4d4c-9672-ba18acd5707c.tmp

Filesize
6KB

MD5
0735f5e7ac679373fb808a26197379ca

SHA1
6d412043448d018e3ed8e063e47c245a3047da8b

SHA256
53f2667821556673d8a0272e14ff92ae379b43bd268a4dd4eec86d9d5ee53926

SHA512
9779ea0070d13c0b491d53b6077335ca167df7531c964e4acc7f2da425bcb53686f79a37b559f6414a7e884e5167739af5ce9078d211aa2a2e1312877825de22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
52d3dfd8c2dc551f35b3c11a392596f5

SHA1
53ee55443096d91df7bff00315f47c4e628c393a

SHA256
7310da6684133c211765734e351b0d113687fa4c967be78fd26a7d68e7f7a98d

SHA512
90fe69128dd085398e8c89de0b77bf406bbf4a1887d8294032edef1cc0758a322f3415a488f53f806f573554f3353090fb23ae63187739380f60074afd94e022

Download Submit