hxxps://drive[.]google[.]com/file/d/1qpZGRTQ58IM-KErL8WJhtyfbDOA0cTHA/view

Analysis

max time kernel
1725s
max time network
1729s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
24-07-2024 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1qpZGRTQ58IM-KErL8WJhtyfbDOA0cTHA/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com
6	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4536	1496	msedge.exe	81
PID 1496 wrote to memory of 4536	1496	msedge.exe	81
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 4888	1496	msedge.exe	83
PID 1496 wrote to memory of 400	1496	msedge.exe	84
PID 1496 wrote to memory of 400	1496	msedge.exe	84
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85
PID 1496 wrote to memory of 4556	1496	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1qpZGRTQ58IM-KErL8WJhtyfbDOA0cTHA/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe66863cb8,0x7ffe66863cc8,0x7ffe66863cd8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,6342097003474399763,7477558841779922005,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2620 /prefetch:2
  2⤵
  PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1ff2a88b65e524450bf7c721960d7db

SHA1
382c798fcd7782c424d93262d79e625fcb5f84aa

SHA256
2d12365f3666f6e398456f0c441317bc8ad3e7b089feacc14756e2ae87379409

SHA512
f19c08edf1416435a7628064d85f89c643c248d0979ece629b882f600956f0d8cd93efbe253fa3ec61ad205233a8804807600f845e53e5ed8949290b80fe42d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
562b59fd3a3527ef4e850775b15d0836

SHA1
ffd14d901f78138fc2eece97c5e258b251bc6752

SHA256
0a64863cb40f9d3b13a7b768b62e8b4707dfee1d3e86a07e999acb87bd7d3430

SHA512
ef9fd3d83ab85b18cf0e0d17e2c7d71936f783e3ae38005e5c78742560332f88be7c4c936d4dc4179e93fde0240d2882d71ef7038289c8cbddbfc4790c0603c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
9c0ebd10a84778bcf7c37588978241a8

SHA1
b23fd71be1516fd1174d425ba91a312c694b19eb

SHA256
154aac879577823c46da9df8ebb70bac791fbbbbbb62a1e483d6a27b1e7a8375

SHA512
161076e0d74f12d377e9a200a648cc385fd4cfb94c80d95405c9529e0889ef57a077c789678252d81ece06e6e08a6c15f303552f6802696ec26b66e8e383e664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bef8b51e448fc9d3fcf5ab0cef8bb197

SHA1
1f0048b87cab0b6a88990739ec9d8253474b0b7a

SHA256
cfbc2f10941ee19aa0d4b176ca0edc4629cdc0df698435bffe2ce1ef6946ee97

SHA512
51ba0009aa12eaa3cf7882c90368c3027c6e6d532e75beb37edd8874b58b3c0782724ac0f5a3b0fef9e35063eb7cbe75908937d5f7611fb23624f80e235f43e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4ff893d5e9243e65b846daab812f4f44

SHA1
ca020c685b30023359cbeac67e67e421ba7d39f6

SHA256
8c02c8c6f87c529a92baaa8b5fda32c055de37ad56352b19afdfc4d31de58ead

SHA512
236c125935a444adb639cb28cdad2ce46c6a12bc81f83577a13a8ad9e7bb1d5a9f6fcffe3687aa8f7786b88118e7a7aeeaa2810022784b10520d0c4e84089df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
94e3da1c60044d79c0c5b7b34f0c21d4

SHA1
52c1cb4c2a12d021cd56cf9a83d10b3047d9b900

SHA256
7c6a82c4c901e65fad55f3b81bd5698c223ada9d279a51eb3863c9232676e69d

SHA512
36cb59527f844b5769600e8c52620895c2770332ad69b5787a8db4e90e1bd26d08f51f078c4dda6c10bdffd569610c11fec44ca3861c0fb6aa79703aca58938c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fedb9788e7c22fbd591bd82509ab547e

SHA1
5c28b8fb755fe8efb5dc1f65a223db63ee6d4f56

SHA256
5d8301ea7744bc1a2b490c506a67ce9916c1fe4bfb6b6706052fc50b78cfe979

SHA512
3a286b1d3f271aa90e815f0ebe588f5f520de45f17d5fbd8ab9bb4f9c3d29f10485835958308c562b73648187b675bb86d0ef6a2d99109ae6c18ca882b998350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f3c9154c60182f7f890167fa59b5d1dd

SHA1
6ed5f55352b1d8bf867e8f880171fe7de08ac43e

SHA256
8588feeb8b2d81958063b72ea1894eea84ddf00681c4abc2210da05e512d3716

SHA512
41f76f498ff622f5ab7aa70c784c06db8f174bf0eae20da917f03bdecc28e13d7f252c46b0f2611fe4c695651cdd6d316b1933e109ac27a4b1f9f687beab5d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
de6ac93bdeb927a66b5c2c83181c0aac

SHA1
48240a66f1c8332976bce6a26852f1d6b33d597d

SHA256
a9e53c9d9745dfbbca98232b31da59af54ea4b4b2d524bd98043a4785e73364d

SHA512
4a118ca549c4c883acf7c33ce5b02ddeff408c8bd88c75bfaa00beea25ce10149e9e9298a57472f1ff296fb43fb4fdc0b2510458f6082397c196982a3dce1492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fadf448e5577e93d4e1f020e20c0aa11

SHA1
1b5b492bc1fbf6b9ab61931d1a04abcbc4cc5af7

SHA256
cd826d4afef2fd341c39809c67b25d0baac02fc223a013fea12573261d5c156c

SHA512
b36f3b2cb8cd6f3bc4d48686e87fc7e689a4803fbbdc5cca8571c87a99a3d5dbcfe9ada5d8aa53ee64f1240ac7ec06a43b3abfdd4ce0f82a890fc106120a5806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ad096e2cc69a10cd39d2820cfb117362

SHA1
bd0023b5a83172bbda67a72ed79463bc809d25e8

SHA256
09b20c2c67a62776e9f8fccac14760ee46e655abc1a75a214174056fffd4aa56

SHA512
a05e54bb7b32e89b1756c280defe9e4614eb8f637b44b93f7968da5571d1cbdf1fc48b959c0dccdb406052ba5dfc0a50762d675309eba08c2e47e51cbe8b2719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
92438ebd226adc37e8ac5167184407b2

SHA1
6ed9ae5352a0fbafe1ebe76c628149ac79785517

SHA256
3d3df27ca93e9a14f9380240bfa71f7b66518ae1db90f40dce2fd9a6aa788eee

SHA512
889e8a13503a4025ce2228769b52e10d3a634e4d7870fe31aabc5c1f8fe4f79faaaf8570c5c409b90d28ddeaaddb9b47167b85d14b4be319cedaa25f032e7d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
64d5a3ea8494ca20664326eec841119b

SHA1
16c5292d760ace159211653ca9244a561de6e303

SHA256
cc1f46e8fcff75df38886c148310194322160b5d28cf8f17cf2e5106f016e73d

SHA512
a58461c1ce359526ef3bec1a0c3b478c953144ce8e0479e831c1eaa3dac07b95be2d550826d4d41775226ae5f2d43988867821fb08efc2cfacaeb2c1fe67f3b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9a76a055cd7b53d795a68f82ad6f87ac

SHA1
e7e3ac6398488730b253e72f5b8f755ffdec0026

SHA256
1d398972bfb58365080ed561452c40b96c56286e307b7df5dafc1b85e06b4888

SHA512
d2bb2f8a27fa792f2bf627ccbe7414a5225d545a1edea478095da6db8fcf072029d48a52908e243f7f3ce5fbbcb8a26d751446a7afaaf311bcf5b3556f6e6809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
72f8d26ed72beb0c69f2fbbc4b173da5

SHA1
53c44e13b8c14608e476a3f5cdcc4c45148c2ee2

SHA256
6ee92eb403058be5ec09bd9c186a08f0c093ca2b7a8e49357c16805518dfa9b0

SHA512
d3ac8074afd31bd9c5cffc1aee29b296aa7c14ec1e0e8fce49e7990946d3a84a4e0c2b240d48cb9e628a6698109856231973511c9c99c8c8ed66ab0cbfe255ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
98f448152dbff6e0aa984d6a76f1c44d

SHA1
62469ccaf59d9f405a2da49b0e8b6d48dc251110

SHA256
24d0d38bb996a5822da9d1b3667e02150fd70b6b0685374ef8cbbd99b9a2791d

SHA512
f6e1e7fcc14c0fa4c8e7643778e0a6d8c3bfe7eef6874ded6b99964142ace1034c1f60005bcfe3660da0f3872dc82888a21bccb35a5d1cc62bde5906a52820fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
61002fddb807e69fc6ea56a7cc498185

SHA1
43e2422c0992fcef4863d5459005d9cc73928738

SHA256
a49b4502088fe91b0a94b3b3034d87494cab936fac2c913e027e9689d9af18b4

SHA512
62e9a44731c108665cce633eb296aef1a06cc28bdd767f10fb15b59f51cf09ed6cac630d77c1fdcc74482234609af4d40ffba223c86812fa0a7e322e7cffa8f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e418b90c2da1adfa5677afc202c47d9a

SHA1
602bffc0d09a61c7ad18a7e8a02814bc29390658

SHA256
681cd46dded0ccfb2ba14176ed7c25f756e71f65051ca1a152c14576b0ac7123

SHA512
2786f7720fd8e1faad9564b2b16874d33a6e1e0fb879bd993b747030905257a6135b23ffb23f80f9446c5d7dbf4baa91e31a5d173a0a42484c5c0723db707baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0d779a4b89c2ed4bd9f56781b4a5be81

SHA1
79f16a3e88534df7a67488ac4162e19c8eef3ffa

SHA256
7d71f834a6cc278f69819e1f43978c45d1ea1e63bfe109591ab8720d547df509

SHA512
4e85612c32f3a78c531352fa863c9e23710e4eda4526532ea212d701581dd6edf72ecd8fb9fb45d9f829214612b143af15e723f879a49b145e47c06fa593b32c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
42922a72ad610720126128e222391625

SHA1
d2b261f607c1110915f9c4d987df5ce3fde5be40

SHA256
54370c8baf8904b65c0b2e7178e41e5377525c8c9d7a1568feb429c45611fba1

SHA512
0b899e74071f597e4778a05904df72da77f3d0c8e56a607a325566eacc241a70fa7d76fb948989c01bd6d2a9a61bfaccf11946ba9c7e8a00d568416fd67369f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
837fced9ea1b141044281389a9dbf01b

SHA1
b0eb0e9703b38d125b24c3a7eeee4c179b54df72

SHA256
078dbd27dc9cb02703b910ba0f3c5c5279d9394237c2d15b603d663439db44cc

SHA512
02c9b78e642a4348a9e7d93e8568e8316862d117553dba6d78138bc929a0e6eaea59b78b66709538758ee55f50613cbe7fe7ef4b144b278750e59e74ead7318e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a12c003e22aee4d605ccec68dd1c7c2

SHA1
764adcb6b4dc7a91775b526449b68a8c59cf1f99

SHA256
3caf60f76acfaec6f6ec7326246c8b89ba5bca71c3b1fdae53c03cafc9fde242

SHA512
694def9fe6b9e870d51fa88d2b22f1d4940b64124cae792186ada3ce4a4ca3cd73c9a906cb01881830c69344283d4cfcfedd9a6cdd100ed0e750cd190455d67e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
78383d5b48d7dc5a0e472042068f30cf

SHA1
53d9bb3b146550af7f81d288e991b9b4dbd67864

SHA256
d9050b36930c72a4e8182b100ef65d7183edf28fe70225a42c274d7ebf3871a5

SHA512
71eca648248a7c54ebb1673623af30b69a3b0db4d0803c8d7d62198f26e16c9525fcd3b49d886090b3b10fa0b8f73504d257fca15cf121ac0159da4994df290c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
45b1376c3438401b073f80d4721b67f8

SHA1
694dea7307de776f1ef306908757c7b47c37cde4

SHA256
7abceafff9ad7d81e8318382c22443b74cca12b75d69770c0d55c16e8a6badbe

SHA512
7cbfeb27edd5bcd59b317cca968085633665efadb43db4691c22e550b98eddc606db26eacebe019ccbe2f70393d0a712f13ac5ec27f4865e81d3ee5b466c99da

Download Submit