hxxps://drive[.]google[.]com/file/d/1Wj07ngMff9_V0N6-76x4czf7APGZn0Bw/view?usp=sharing

Resubmissions

13-08-2024 00:24

240813-aqgpaszajk 6

08-08-2024 21:05

08-08-2024 21:04

08-08-2024 21:04

08-08-2024 21:00

08-08-2024 20:42

Analysis

max time kernel
1723s
max time network
1724s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Wj07ngMff9_V0N6-76x4czf7APGZn0Bw/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
4276	msedge.exe
4276	msedge.exe
900	identity_helper.exe
900	identity_helper.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4912	4276	msedge.exe	83
PID 4276 wrote to memory of 4912	4276	msedge.exe	83
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3140	4276	msedge.exe	84
PID 4276 wrote to memory of 3820	4276	msedge.exe	85
PID 4276 wrote to memory of 3820	4276	msedge.exe	85
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86
PID 4276 wrote to memory of 376	4276	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Wj07ngMff9_V0N6-76x4czf7APGZn0Bw/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce08f46f8,0x7ffce08f4708,0x7ffce08f4718
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,931121269195075766,10633363308541156519,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
5582206519935a6e442716c07e0ad5f8

SHA1
6f082b9b7c9f17ff158bec49941d75c76399bca6

SHA256
3c95e5082d571ee14c01868583a821f7c894e93c21949f380958a908050caf91

SHA512
be3033fd78f1fb42c610a350c3d0358df9185f677d943371ce393da7c59be5472d0836c7064df1abaf73578a701fd5def2b220aeff3d63d45f07ea504c6eb3a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1926eaab6ff3a3a6a6c6b6f04519d75a

SHA1
f382dbb0a823782cde1f4258618fc8175f9da24a

SHA256
0209f793eca8844db5714ba69cd63fcaddfa411dd641c269f7fa2f417c46ac1f

SHA512
447c1008473e1217155f73081a2fbdb24e44b7f4c9cac1d24b352e396db84014bcd4909fc6d74aa83bb200f729dbd94e57eed31983325a6bc84544dba8404d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3f117d966e014b4ccfe2420c9ab4d385

SHA1
761cc6e45499f188d8bfc2a4242b6e9113eb29a5

SHA256
76311ae5316a58b510d9ecf7b1c0eb3da4dc20ba17624f32b9522f48c7f75d5f

SHA512
48a8fce93550c45134785a6388d03a0080531be92cfce71d0d7fbd485d80c68c7cdd01d4ee89ba8f7dd0fcbc02077150896e3796059990bd73ec318aa2f78e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0021cb9cbe447fe1cda1f1b4c4d84483

SHA1
ce7080b7453a93def929b8ba34f060e6a4280f28

SHA256
53dff65a7e19e6c80f1736854e47a59b807cf461d7de1d34a32e5383ac3929f8

SHA512
94c33d21010f9c5cc13519ac5cd66654b656903f4e452212d83b66bc9a3c0d09bed46e6bf6dd779e1790a9938cf6a1bfc9b4220e7cdf7af46cf4d90dd5525649

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
818af29692a3518a174d5c4a25620a35

SHA1
193a311ab9f3221655a06894bc4ad1e6d27a72ad

SHA256
2230899b03aed2ac7ab05562a6169eba23a429609b35f39e0e4fc73db81a7a54

SHA512
4a3844b8d1295b7580593d47508ace0ef2a2e83d8e330f368f69782983f6cdfb2a4c0a84fcc9f5bd140f127e1c33acd32433d85e8b7d5e6169207448dde3c7d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8cac546a29e6f08638f842d8c29be9dd

SHA1
08fa81bc104fd44cc86d217b27e8a210fe0abd4c

SHA256
01ef0f4cdd39470de23dc117eeada89ab2516eb2b9ccc6d42b90b95ad5fd1fad

SHA512
284e0d08f422043898583117192544268fc97a297cc860be2e4866dbe4c938a082f5ae10daed1912d529e1d453ea96b911cef27e32734a7cd79f72e8a8ba98f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
276b77c7d654354cd08af1181686d25e

SHA1
04186cf9cba36bb8497745dff1292c1cce45aae4

SHA256
5ac212ac388d05b2d7dc9c6fccfd96241db0586261ee474e4056bdc983fa0cba

SHA512
b50224b3172abc5bb98a486d33c698aecd72f014a29944dbc05a551c04907a3836796c9b5fd57404a0e3202ef1d221c96288b7c475d9adaad1953c801f4c9f2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
01ea16b542bc9e7cff2bfb89307ee425

SHA1
b50cd2d87eea7e0725854f034e0cf9e1fd665415

SHA256
21e7df4c82b93bcd2b54ca091a008c5cf5e0cd55939777eab11a6e702bc1168d

SHA512
d21d0367fa5fc52a74b17588759abdd613fcdedcf865f6fc9cd5ff167a392ffe93316af5b437e888687ff0d0b2bb8d0497725e6b016ea1906388e55c5ad8d374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
39aeb42040c670f543aa2d9778a9527f

SHA1
e9be65262d37c3e4fdb3d78ca6fed03c1e947ccd

SHA256
fb5116cecce2fa526bed9fc519c81a254da3a647193fab9a9c8aecc35985d0fb

SHA512
e8d09b66b25319faac4b8be8140e058fea28c568abacefb9e75e5e6cdb433c445d0d213aa90e8cce1b054ba51094af34a06c60dfc4bcdc9ff6ccb77e3c1cb7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b1e8273cf5120adbc29e41604ac1ff42

SHA1
f6fdaa47c5f7c3becdcb2847fbf57febd9053926

SHA256
b3d4da87396dda3835296acf1e957064be8468223ed6eae895401db01b1f47f6

SHA512
d7c224f35a1c562f806b77f7a7028e14f60732f813da25752adfa223824692504ffc158bd06ba3cebdadac327b6ec7334b027adf3b3b5d79b1f0282f7c45dcc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0daa838baddb7ad9f0041bc86e9efe71

SHA1
3467fa098facc40e2a117537353c2b94ece05fd8

SHA256
71f9c2b4c69b61db92f26328ae4f745c958401bd28e671c073a83e170a25d933

SHA512
5e59447d466c15cc3f82365e53b0afa91ecb78998704ede598d8d9d0b5b62bd2fdc11f29fc1da14e1a3043b79ec1c7f451edbb2e736309bc1465b437fd1e98ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e2dc99dcacce8aa906155b04c4893bcd

SHA1
3b28ce968368bd3c2be90141ebf4965c2da9a364

SHA256
f84c869d204e9cff4206b0deb1c19d668287826ad0f749cc8e68e03fd1c2abaa

SHA512
ff6a552604372d7e45a859b82cb48a4f1e5305c35925c7a5279a7aa5cf5792c9d2699fc9438bc5aa7230bdf21f74a7ab0ea53541d0a3ede9830dfd45191dbea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b245ec74d518261a93099ed01804531f

SHA1
ee537f8c98949b7ddc6dc35e7bea2d826cc8aaa3

SHA256
5e88417a7b459bee85ad4397cb1f996465d685349498707a180b7273c0213cf6

SHA512
557fb1435e4661597750ee14af941aadf067e96139b794a3fba900f240671908b7811b8a40b06538db90596c895c18de302c71f43e4e1a3e7a4e64c1a3fc0084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0d3f82c886ff97f6f4448b7dea3ad230

SHA1
19d59409ed1f2420feabc965b25ff636fe7436dd

SHA256
113d64ec0361d051d0031a15ce0d21058e6b5aa73d8d7b0e4c241432816e8a30

SHA512
92ac977c1bfaa09c774666b6e732e6c41aa52622cf07f546edbcf2c49c432d15647630d3bde97292ab38ceb674c5a4839033d4d91d022e41db3dba9971fa24dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e547415fbbdc24e3f57bdba1ef6d1932

SHA1
1548fa5d2c01de3fba13e27d38e6ee930d9b4bf1

SHA256
001b92917085640d82921e89f490e05ccca34ae98439b492010139e72e107cdc

SHA512
ee4ffefe55511ab6aaea77199f9de28fcd9cfb478b83a1da433b8c62d7741b60e4347d9241525a372c720d8e487e5c2c6fff508a344243ed04a5c3836deb9382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f76a9c83d751a5d089434ff1df24027

SHA1
6390348d2b38993fe833004adbbf29a4b842794e

SHA256
77c7a1473607b1cc5e3d38f378c38703991f2ebb021acd9ac010bd6e0eb3e04b

SHA512
fe772fe2a4fec60e4b2b133a065a6ee06daf03a88ee8f21083e36bfd51736f67ea98bafe2164f518a0fe158610110c70edf59c97313bd77ed7460a1e0208e6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ccc9c5afabfc432297767bdc7f2c0871

SHA1
6b47668975530d16a3a0506ff8b6dabdf16c9236

SHA256
b222367274f02aad6177139b230f317ac0611704713ee121d56a3f89586f5366

SHA512
5fbf106dfe9ef2e28e9a66ab94bf3b37b893a20da420a9dfbbf81b3e8cd6c054fc626444880688b7ae258c3f9bf6962d419da4f1d07ff62aa720175984630604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e61ab8591d94d942682952f4f6c15572

SHA1
3ecd6bfa6f99f613e33886148c128862bcf63d8e

SHA256
012b67f70b854c15b61abe120f33d264353ad126238654d04bccecc1051a33db

SHA512
b1464a1867de831b41378414f009ab7e2db3626424a21948d5f81d05203b3c2a5b35856c059e982c8dc8d43477e731a85215a314d3fe09773e820185d6987b94

Download Submit