hxxps://drive[.]google[.]com/file/d/1EabNGLQzKVSOwrayWVUUOslaLx8qEqRf/view?usp=sharing

Analysis

max time kernel
170s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1EabNGLQzKVSOwrayWVUUOslaLx8qEqRf/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
18	drive.google.com
19	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
2776	msedge.exe
2776	msedge.exe
2824	identity_helper.exe
2824	identity_helper.exe
4448	msedge.exe
4448	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 736	2776	msedge.exe	84
PID 2776 wrote to memory of 736	2776	msedge.exe	84
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 3000	2776	msedge.exe	85
PID 2776 wrote to memory of 5044	2776	msedge.exe	86
PID 2776 wrote to memory of 5044	2776	msedge.exe	86
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87
PID 2776 wrote to memory of 1612	2776	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1EabNGLQzKVSOwrayWVUUOslaLx8qEqRf/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff815d46f8,0x7fff815d4708,0x7fff815d4718
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12994312850891083238,2723598967236739160,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5192 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
dcc53d0de4b9b4359ff550aea2b168d1

SHA1
583684720ece91921b2c83f2df7a4449599e9e77

SHA256
04af6f6af156d92fb20a454bc277f5fe016439316b92cd93f1900ce12897b800

SHA512
41c53b1616063f4236dcb9a147e20c7dd54e0862e15bf160567644f3023dd69ee208a5bb551517c800c1e4174de646b8a1f007d1e12829586eb39a29e3098874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8483f20e8355b21bbda552f4910583b1

SHA1
483b65d588fee3ac13afe2da1451b0173c370753

SHA256
33f4bdf42f7a775f8078dd36beb15e197ca8ed4d00b8d7a07febccb088012d5b

SHA512
687f7c954c9f0dd45aa3f6604d499088b468cb409662153e0b2aed412453029a3cd99c1f786f7b1c6f67ca4209730632d21761c73d86a57d2bd339a1d94f0421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e842210335ed54c86bb3034d8fb853a3

SHA1
71eb21a23e99d47c2fa751abec1ec03c45d18a73

SHA256
daa25e9c187c039b956e00a9f02800f7f8edf078d9b637d95e7328b44726a9c1

SHA512
22380d2184f16c65a16c6068619341aca5d3b5c7733e67f1155ac999095a0298396701ab4983f619f029e64d8e75fe8761221de7f4c4598b6ad01c1f4c864fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf56c8ad6d1543b33c953afcfd6d03f6

SHA1
2772bed1b10b8c8f3a1d01383d1e4abacae7cb9d

SHA256
6e6a4e5bdcbe2a04f8e500942df00434993818d4974fdb71038297c01c2e4674

SHA512
7155c056a99864cc3cf6e688413f28e0b79e352320966d12124be1f37b57dbd4051126ae2f2135d059681c2922d7bf12f13bcd806f9ebe883865ee640aa6677c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cabef9079bbdf63408fe5c0b7b7da00e

SHA1
33cde4b9c4d4d784eb422c2d950bd48e3f19b1d8

SHA256
1699e283be20bb524b4125e0e8d0d84cf1953d052dd4c2706f1cdaf60ee02747

SHA512
695702e7c0442586442606e6ece81e92a48ccc97c073fce193fa75922dbc779c673e9c93f3e9e62fe3dcd831c30940e7b8f869871de2a349ea510c6366bb5850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34e2962af266635081181da7f3a9099d

SHA1
0c01d6f440677a52d36500e08f0430ef9883e7f8

SHA256
73e6ad00b576c703852e482d90a97cf3d779c9a97fb6cc967962d761e877e75a

SHA512
a690bdd978d26e98f99d7a7ef7432b09deb96d783008181f5102a8cabae9549972552936700d5b3ab94aca0189aff7ef268d3ca937bda6d4563bba30bd8bf6cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9e3e65266ad93668ec18aa9530222e0

SHA1
4d10f7baa42c03d9b1b2d2d5c90c54fafcd4680c

SHA256
08abe6167b35874304522ea7862b2b44a957044b1f4aef19c5dbdff669394e9c

SHA512
7ca66b1b2d0af27eb857977637148999d4db90285a70279b70b14d08a00b275cf2eaa297cfc2fcaa81d988fa1bbd25c1350e966fabc4269f261fb1e494ce989f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d0f4060f4b86aa54b6a80668f61cab6

SHA1
dcb7e5c5c60c6ac795fb434309b03fadfc7f6dc5

SHA256
327491fd9bf903f5aa3123104f372d6328c78db2d5310d60cb449c9741597cec

SHA512
b0a4252960172f598c52e293ed36ab7691cf79643c0b460f079b4192c10547e7d616387dce9576203ed6052faaf54cf78413daa895f0c6739767b886e5ce2425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ef5411001972810498c56f279c1cef2e

SHA1
6ddf7be7dee5b129e3ac50ed4e3e5ce988219106

SHA256
e71ce0ab342b03c43a62257c47e33bb0566afe6b87f3ddeb487fa2d3baaad1f8

SHA512
7ef48506d10fae3bcc8cb68ba2cde7cedffd5f5a8bd94665c3a297e83b2443d950e08e747e060883f1aacfd7355b6ab167c61242fb70df6f571a1d71543ac279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e9650c2c657d1f58987099471cdb1db7

SHA1
3136b38c06ce7c6cc7024943b79f4bffbe80b6e0

SHA256
c5f2b6376e08bf6c819407eeb9db56f3a857a22ffb558737e0c903508c747bed

SHA512
23cced142df9a8226dedbfa37e0655f26ae6c29a31629d0bf9f6542f360bb60e4c617912e2e048211df0e530afc2953030ee41a3dcf76841c707e75574543689

Download Submit