hxxps://drive[.]google[.]com/file/d/1_yhKnk4abuHODVD8DyMH7vSdB2HdPGQh/view

Analysis

max time kernel
145s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10-08-2024 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1_yhKnk4abuHODVD8DyMH7vSdB2HdPGQh/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3292	msedge.exe
3292	msedge.exe
4352	msedge.exe
4352	msedge.exe
860	identity_helper.exe
860	identity_helper.exe
4600	msedge.exe
4600	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1456	4352	msedge.exe	81
PID 4352 wrote to memory of 1456	4352	msedge.exe	81
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 2640	4352	msedge.exe	82
PID 4352 wrote to memory of 3292	4352	msedge.exe	83
PID 4352 wrote to memory of 3292	4352	msedge.exe	83
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84
PID 4352 wrote to memory of 3592	4352	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1_yhKnk4abuHODVD8DyMH7vSdB2HdPGQh/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff81c903cb8,0x7ff81c903cc8,0x7ff81c903cd8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,9805489627320925150,5310606185304229742,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28dad1b3-b849-4c5d-bcdf-4e3137ee7763.tmp

Filesize
6KB

MD5
1b313a4755ba9bdd4e8da9f152473f80

SHA1
f5a5c2a496722ec18680d662b4bec1ce19a94365

SHA256
c2d5d706a6b4a496fc6c47c88fd859a3f6b519d716f545bebf26d36d32372542

SHA512
43a2b8e9b8758aaf4d0d0cc1211c5d285e2ec6f2d0af9e0758034fd85cc67c4dea9be3c63c8b0979d6b7ca376be51316d78b91a8f94bfba1a873d770791e01dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
9a25111c0e90867c7b8f41c5462abfaf

SHA1
0619625d479f31cf145c2e3714de0df4a69169d1

SHA256
41bb42020f1beabc9e72913ef6a33aa264556ec829ac70fd92c9c9adfb84803d

SHA512
0fbc3c64d6f5acc2c0dab67924b0c669fefa994f449240d1f6b78dcac3538343938a4fae972726156189f05806d3aae0e333035df52605ffe28886b82f31ccdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
49a9456fc6ca40bcc1b88025ec90e5a5

SHA1
169b9dce429128a1e8394da85790c9c2d9d26ae0

SHA256
9ac951ff7aea304a6245768325cd6bafdeaa90e1c759aa0b9de3a9c3de04f3f4

SHA512
38f932f366b1b3f5c3d5ed52a2a06b632b56acde42b29f761f2688dd74d1c2627424d0d25a997d27e337efa0189c6764b3ad0e27923c435ed48430844dad5f98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
21f6e5eaf88060a04956922c0af54fdd

SHA1
8b715be1f98766fb8e1061d01a7a9b1fdf641e40

SHA256
20bfd04f11ab4501e7ce5fec7a8d822f7aeeb664a0850931c72e3a99534d58ea

SHA512
b52cc1b50483f7a780ad3a75583d0a7f6bb80d5d9dbb386bd9502c2bdedc7130da2f87251587d06bfdc31d3a09dc90711348969571c0ceaeb0858486fc4f6e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1d2b0d6aeeaed0d4e892008459d9d1d5

SHA1
0ff40d3ac3d03a9bb9c3ef7d6387b7a9a9aa0fad

SHA256
a0ea1a2aad7b4b388b711671b55b05732cf71edeb30952167e150dbc89b26f44

SHA512
7c945073918bcb5386e73ae3f06d7901da099dbf6356baa21f33df0a06e4c1daf65e5e045875ef5e985f5c526efe9c0d51c4ea10937f97702ae25b5463ce496d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2d5f90927812294ede174decf4ae5557

SHA1
ff86c8660d2f291a99c303cb858552b26e356872

SHA256
78cc6a661f6a52f6593d0f272473aed648b31fb7b090de8c62810f2f50c8cffa

SHA512
3c3960a7e8fab35eb55d1f9173646335882326ddddbd264ec1022061fbc948188f783ebdae7ab38756e80ea5faac6b298610e5520c78c28005b2822e9a9243d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2f0cd963c0935c9be6745e302e73bb6

SHA1
8ea071cc4c2074de00aed8d70197cb7d0e671f33

SHA256
29b1e655f7d306c16b9b1dbc95480a29e80f075ed3e17546953d9aae3d21810a

SHA512
eb2d6a6e610b446c2aa154768912992a79b7fe9ac77bd48e15c01a50f61172e295db0bc2089a2abf97ac2499622f0bd3e568dbbefff4963176c01c0b5f719315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c274159dcebf2ff84275f1ba31ef3db8

SHA1
121b183add818f5031d77b48529db3679216ddcd

SHA256
feee76ac0fc19f085596022ed826cbaf222df06f08f2d64d0c07a4b918a317bb

SHA512
4e31f8b0e3e05b17a6e559ae4a56101436f85bb0e81ce8a2e476e62c98bbf5fbd829f7615a2746a4df5b456124c75130ee4d8ff2502256cdc960aa9d12640c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9fed10a0097e745891eaef4c54656bbf

SHA1
1a2f033c8ca10bd554d027605cab2be123c16033

SHA256
088bbcfdb63dc381e3f6d9ff444fef2c8a06294604a71def497b80db2f789d3f

SHA512
12dbddbe36138029734e1bc5d03cab51684793e683261774f2fe151b69c4df4bdd9b65fea677330b4684b00d9b7c9a120fde60155e89372bae4e022dfb2517f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
42a948191276612cc3927d8a2de15443

SHA1
c00fffd3df7ae4f8adf8996e4cba37f296711f29

SHA256
b8f63d0a9d4d885942d61151ffa00a132940c256cad6ef4c5bbe2fc0b8a6ce1e

SHA512
ce24febe647a4be34ede50e6f73299b40d166d84b8af3713ac7fb6156ba5d782e8975918fa9ed45465ac8c5b90c702c82726b2fd4acafe6a85789a3235e2208c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b0ad.TMP

Filesize
1KB

MD5
43e6954dce06c5fab3bcaec0d6ec0c4a

SHA1
7e67de70b94a29531d2f0819a8a88f15831e667b

SHA256
781563764b5cc14711dd56574fb02719915ac5e9935b67595c0f065aca258f15

SHA512
80220816cde1546c8c70b1d859fd68356275229fc759c6ce599d020bcdcd562a92d03c2c718c8c87ba4e8e33a8d394171c519a62a629c370f9069b23440ba581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c31bc86f09797531357ed292885b8abb

SHA1
993c99900e5d92233f96da207070669631e6c03c

SHA256
bdd9eafb48c62283c26ea513896d1bed31dc8632ba7eda82e05c3fda8aae0fe5

SHA512
4e72633579f9bda6e70f3fb738c7d6d75f3ad570e48b9c167434c57a32f0238885f33ae031c2f60ddc889bca7bad15537323b65ba3c3cf6710d909e170938b3e

Download Submit