hxxps://drive[.]google[.]com/file/d/1sZMAkdyaTaGSK5NNYw4nL9hEIWQIG42a/view

Analysis

max time kernel
1785s
max time network
1726s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05-08-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1sZMAkdyaTaGSK5NNYw4nL9hEIWQIG42a/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
4232	msedge.exe
4232	msedge.exe
5500	msedge.exe
5500	msedge.exe
5848	identity_helper.exe
5848	identity_helper.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 5784	4232	msedge.exe	80
PID 4232 wrote to memory of 5784	4232	msedge.exe	80
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3708	4232	msedge.exe	82
PID 4232 wrote to memory of 3424	4232	msedge.exe	83
PID 4232 wrote to memory of 3424	4232	msedge.exe	83
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84
PID 4232 wrote to memory of 5228	4232	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1sZMAkdyaTaGSK5NNYw4nL9hEIWQIG42a/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffdf4d3cb8,0x7fffdf4d3cc8,0x7fffdf4d3cd8
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1640,15843565329663331196,5042797140817571491,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5568 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e681bda746d695b173a54033103efa8

SHA1
ae07be487e65914bb068174b99660fb8deb11a1d

SHA256
fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

SHA512
0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f081a02d8bbd5d800828ed8c769f5d9

SHA1
978d807096b7e7a4962a001b7bba6b2e77ce419a

SHA256
a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

SHA512
7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
49e357cb5a880b32ecd272e634e58628

SHA1
6410bcb0c736d99cdbf58970a5a3fe7ad5e8e3c5

SHA256
2c6fb34749fc24cecf4ff863d4027a719868adbc8bea705759afd555c5e07c7b

SHA512
7aba0b015ca9c6fd1291a5505d80a69dbc8c6cdbf8538e27e3c0560dc6cb580888bd8b1d53c57a33649a8029dc2fca2fd7d4cee3f4fb8a949546b8cedfcf9284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0200e7ab95744824da1c6c15bce5d890

SHA1
9e69260592996956929397197c24c43be4743a05

SHA256
514f18ec6b3f883de9d2757f83be69e8181e3ad1ef91715f85b794d7b445e03f

SHA512
c77c6269c6e92cb032d60b3ddc40ded7615712e2a50ce5dda5d448344e81a6298f16696bbde36e6ea14807a80f5dad11145a59c4d45752dc0290f3e9ab0b7d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3315954f04aef12d6bf93fe2a939ec21

SHA1
5e489b0df193539c0aaa0c1597ec710fee1c2c16

SHA256
5f54d4957d314258de34afd90315bec178f81d3ed107138b0686f1322ba02bd5

SHA512
4418768ba819295f387540bb8141328d868d32b1c156a88305fcf2b56b7ef5c98579f582f5c6268805138514b08249d94c34012284070f07628b2940c41988d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
29419bc49629869fb15db9d994ec1aef

SHA1
fcd14e23fe2642c2cbedb79c27cc9c8e20fc9032

SHA256
7ea0b8c7d9a9387968598e9833804f561c3553243b28c918f44444865c7d886c

SHA512
60ec1c50e17ee4e18f5130d9eac198ff0b25317111885be0b8d73aa3ae05426317824ba09cb965198bb48bb32bc7fd0801de91b2494cbc01f71faba3c096f0d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7e37c3af49b10274fb23bd75869393c4

SHA1
98a3bce545d00a67f200493f9d3fbc67a0cfadc0

SHA256
4ec2731bfefdc68a81aa07ba45543ec8590076992f8e9630cd0cbe38a54a3073

SHA512
3a630f84da4f5efff4f492de413200394fcbc77d2d655042b427ce59722c3f351162da433ca7689404b8b73a688ac1efb91c77f1500a02b47017cd40c73e91f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
380c2aef13d8cd57a2598ea034c9fe5f

SHA1
ae0f52c197cd5a5b0b5d589ff7fa44c3f190682b

SHA256
5568369491ff20460e654d37cc322bbacc9f2df4903ee0a554e49b8684b34a0f

SHA512
ca51541f847e04a78dcbeed2c8c4d731a38dc7c27f4fb09da617dd58122c8c391f6218b1d19669d1261c51484f7a57146226c0cf5a9642ed861a1d08d16993a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6605eb944c60d2fa6bba380ab128786e

SHA1
318752dfa9061ff06fe40546427d8ab09fba0621

SHA256
ba509891ce121978ba9a34668d4f66b4b1464001813005febf93eb3fd827dcbd

SHA512
776b5b5fcbc8046739b2770ca830cc5e880a0f1f3135f4792187d85829ada127a2571791e6143f33c25aadc3ab1db7eff2f5c01fe8beac847c83fcc152aa6804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
aed62f412f15a955c3fb80af2dd6a5cc

SHA1
21a7a46055c69700b3a454a942da65625c4cb944

SHA256
93c5b03f095ca83491556726932476387939fdd37e89c2e195371ca3c934626f

SHA512
e090efded0552dcc7ca5f1615d70d96670ff475184038cb0065222aa2f1e11ac0ddad0ab13d46949b98c3dc560bd65e526144635a4aac388e036b0d5ebc46e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c5ce7772c8408f4a13ffd617b1d55a74

SHA1
48e8805b57cd41681552a704bad280fbe81a71e3

SHA256
736087d05646e3f17f0718b5555cb9d1415e7993b62323a5ce511c764325f979

SHA512
539f4e2b935f71c9df2d2e30ecf71728842f5f4df83d16dafcd9af89eb4248c5eb31e8452b2ce8636e82eacba5e1f4c2343d52f2af68116e05dee61a8676714c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
245ba305ff4cee1e1669a7969e34d2c7

SHA1
4c0445efae2e3ee2b51ec6df4cd061ce13ca2248

SHA256
05bf00a3308f862ec3ff72b3397c5dea5367d81956ddd3d49a6def1cf13fe447

SHA512
d581322040ed4142d9c5093a54cf399ca937731e948d948e11b9e1dab6acc1e4421303a2a2f65e6e530e708029a417c9d19dd65656630bf4ab97efd7590fa4f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
02a99c07c7b90568b93876e7f54af68c

SHA1
34d8af2d0846416d43b488370b55d48f490cfcd2

SHA256
b9987d3c51bfd00b9ef9f07fa55e60f30dec6e996494456c136c4fe4eafd5c37

SHA512
78426008af1d89744f916ef5a929de5c5ccaff3592ccab98e656faa11c3a6163deee07b6cb0e140eadfef6c36044c9e32a1e3ed494227b11fa3cff3c876ea717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7394dbcd24a1227884a4e5d1f4366d09

SHA1
00628a763360bb232c44be7e2d380fec6586340b

SHA256
5a4492da8433133cdc51ce6b70683e3b3b91109b71517786c93f9c62b0d1de50

SHA512
347c170609e3b55dd9c0403df99811acebf0f0928301ff99fd720c63bb1a3f327ddf183452b0a53e890296337cdbf2a3444e4757129ebd539ff00c171500eefe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4061abc1147370561a14f30b7fdabc9f

SHA1
7b20db72691a9964616861e56dc5f42b5aa7db0c

SHA256
a3003c6fe9d2bc6e351fdbdcb4493c1d47245463c44164e5b1f85971143b84f1

SHA512
7bf6c3a98c15814e478bdacdad4bd404b36f412a7341be0289758b9d8b6634b714bbaaf6ce5379fae486cc75da54a9e4dc5f68e00c92c98b7cd2aadd1456e641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e611d9dc4926b69224e9613807049829

SHA1
e85304c43c869c159bafb56366f5fa50e1d3f74d

SHA256
ea036c008a2405b943c671d1a9c486dc8072f5c26ae16474fd4d4c5180975f74

SHA512
948341b3e51d278970250d7aa3bcf93e25491cc0e6ee0f20d314cb1d95dc8e3264efc11c7073040c80ea83cd98ce17fac203951826ae9bcfc85751780d0a57e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4fb489204be500177f52bee8027f3a11

SHA1
c83da29bcd53991536a4cc4185177834c91b3b1c

SHA256
4aa910e1b44c9675ba8d4430b4b05290087c04c5106a39f142ef686215ae0634

SHA512
d034986c69f299dc49627f06633430bdc1b76b299fcba6b8a3bc5867cf84e73a3cd6ad5b8b68a296844777c017238aa336764eea81c2009752aa9b58db5f13cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
86bdb8ab188c48ea0160ac3bb50c18d4

SHA1
2f6d5a035a0a168b388c87f5c4337ccd8dd9439c

SHA256
bdd4183a9b8eda1cb9111409c746857bd259101c2a9698ef1e6208e9ecc8382f

SHA512
e82e82436c87b89bb240bd9e9354ffb7ea5c41818d39c5ad479db6421935409dd4e46a6313f53d600eecbed53f8ca0093c36c41348aecd92977699ed88e0bf58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1e232690490599b907c2eb44229c2f35

SHA1
9306035260e4a1e3ea506d4f203abce3d9ed5c24

SHA256
19090da6c0afb89fd75c0523bd581e4d2a3ca7a1048a49f544cd67d242320220

SHA512
6089c1d60cc5c076eee4b6af43a94293f23a4212f6e1d34aa9e9b8ed4d20820d52cc89427976be2106cca79cd4bde5526034cfc604417f0fbbc6ba797ffaff57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
528accef7d10756e354265b69345092f

SHA1
6959cd02ff3fb7e20ccb118604f234a532cd1b7f

SHA256
dd1ae722d93b31620a716a713282696349919ded724c86e6ef1ee00040f66bd4

SHA512
b962645acdc03e39c6e3ee2e367938b1f4842bd081c6ee3637ff682496777e14e0dbd24d4464f4f8f8e28cff8b6bacd27ea801f9df71137db4ddfd720f2e9744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bed8e3427b123e37b3a5499a5e67f3f6

SHA1
875d538a2f6f9b2d80a789970af9097b6316b520

SHA256
3592a4f265b5b41a4e6730847c7e6d41bdbb24b026e03a832fb057492a38a587

SHA512
d23c7106e390a23ea30b405977cd5d83ce16b849f1875f04e0f19f9a277108873daf3a00932e83284aa823e481f4ba3bdb9c7a7a74973f2accb2b7f13f878e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03ceebe828d01c2375862fcc854ab914

SHA1
1b914d0b8614452209adbe0f02525277ad38cf7e

SHA256
e14cc6ce1ff45ee94acdab605214b24ad2d07f9f4320c664f3c24c70e8d22527

SHA512
89fc67ef05aa7ecebbc3fb5dbd9f29e53d95e8cc951bef448cb491558db8d945aacef788befed9c5629f8f52da2aaaf563aee8cea49b9ec722665d68a2a93d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6380486242d3f40011dbc345fa1ab819

SHA1
27c10c5dd036c0bfa8c5a634625effd8650d5962

SHA256
85b438ed1143091ca7147e91e9db5a7e6bfb8897c472c7bbd9e06c666ae59a49

SHA512
5b394680cf53f24612e70568e7feaced1f2e0727a0820165f31c3bbdd4e6be8340154b67495d589cee44cc7ffed2b80c8b005bf0fbfb0fbacd7e56dc141bbbe3

Download Submit