hxxps://drive[.]google[.]com/drive/folders/1je7KqLp9zO9hRP3wUtP3EknROHb8jT5C?usp=drive_link****

Analysis

max time kernel
585s
max time network
528s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1je7KqLp9zO9hRP3wUtP3EknROHb8jT5C?usp=drive_link****

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
552	msedge.exe
552	msedge.exe
4060	identity_helper.exe
4060	identity_helper.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4732	552	msedge.exe	83
PID 552 wrote to memory of 4732	552	msedge.exe	83
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 4384	552	msedge.exe	84
PID 552 wrote to memory of 1592	552	msedge.exe	85
PID 552 wrote to memory of 1592	552	msedge.exe	85
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86
PID 552 wrote to memory of 4996	552	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1je7KqLp9zO9hRP3wUtP3EknROHb8jT5C?usp=drive_link****
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc0da46f8,0x7ffcc0da4708,0x7ffcc0da4718
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2264370696598113093,13917226156404461595,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9640b471-9939-4335-8718-8fb5971898e3.tmp

Filesize
10KB

MD5
8fd4e1724a3992a2ff70a6462bfcd7d7

SHA1
5bbeb0ea71ac2d50659a54c76d48fefff27d71a5

SHA256
39e7f96d4cce3b17cd47aea98c8f5a2c7e21778f22547ac3c33b558440cda912

SHA512
faf9b5202af3030dc4c29268e153806a6e46f2d568619ca280ea05266363885226d89caa3d40e507d01aad0fcc5363087735fde9bbef2b1eb0c70dca191c56f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\927ae76e-f9f5-4a75-90ab-1e79867440f4.tmp

Filesize
6KB

MD5
8ee9bddced71e423d3ec91d4dae06ed8

SHA1
23b230cc7eb39f2a3934e1475680666c8ad7385c

SHA256
5b3f74268e796524550ab7e33f80bff5a8189f510f040bffd02329eb54771454

SHA512
6c80a59b63a3cb54f8cf273adf077ad5a2af276f63094d5db6e22d4a7ee45a9e0bdcd7cc7a0ac724ae33a7a18097aad1da95927f7c25c3257ab05e46e4fd2045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
574f1f79075f15d86ce2a3b60650584e

SHA1
36f065390ee288919206a144d271b8b03c4dc148

SHA256
89b33a8a80097eb5036e3540f75f57709523cfc12da53be92e083fcff59a6603

SHA512
f5fafeecf2f174c25d8efcfd1c1a8357dfa416629effe6191dda2152052aec330f4e07a7c2ba32c8f487a2d11918f7353c8eeb8c6b95bc1dd3364cc8f702f549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
35a1d40ef964944a2797d8d28271da5a

SHA1
47e0f5919ae28cc81c9f444077316cfd3a2dc2a8

SHA256
9d89ad07f87de2f74ce39edb60023530e15f8016ff83affec4a04247a9dfd475

SHA512
bfe3baf4cfdb9b97ab21b908971b4a81d10f1b48862904a4cbbedd8c44ead4437c8853767e23ba914c839cbc37fe48018de05dc787f35a6a27d02e589b4a6602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7e53f7bf42a1683954816b3d92ed8c36

SHA1
81a7789b5c4ff6a79cfce23f7f9ff5170dc6b83d

SHA256
1216bf3341b1324cef792ab66dcaec05ece7ed902d09b05c5a431f9f93641e7f

SHA512
a81386e6e88908b12ea910faa6a89f7478561a1ec108ee22fadfecce5bf94c595ead0c4beb1da37106037041feba531cbb12e09878737983c7fb8c9eed8aa853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5d78617bcc5237f9b2dff9fd28017b80

SHA1
125e99c1cd7b575d2e41f85a6ba0b68f26763822

SHA256
5aeefde00e47018a956ffd06065dedcf8a4fef368057f9bbfae8cf14ae205b60

SHA512
2a2117da0e4f9181ee11fc5f75408b2e84149ad06eacb1c211c661228c06e3e4ad279763c73d4d629347229edd8749bb569141e3c55f788603169b7dc8803a9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9e67325ca8edc14843b3ba81e3b9f633

SHA1
0e379cec64829bac59e84220c6b716772e0a67c7

SHA256
6131f4815ed93ccdff8cf5d5a3d00cf26227274d094d31c09f47cb970e643d51

SHA512
2741267bf4ab8124ce9d6c0cf764650112aede8e41b8c188c7381287c59f18ffb895a7a3ea848d6737e61ff93c78f17d1f41e35d511a8461b7f5476aa60c73f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9253d0f2880cffb00ffb5fa3e76e68b5

SHA1
50f89c1a1fbebb98506509af34a53d55dd4f7ff6

SHA256
61cf7c70879c34e2fe774f6e55970530929f2c11164ff685b9772866210d36f4

SHA512
94c1e2f157002b2d8d6ae1470af211347a6394d52c90adb67aac0bb692552cb287256e72ab793eae358a83c7d80e71f4780884c35b4fb2ff4c4a880be1f8e21b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f978b1db5099c40fbae93c14e0381470

SHA1
cca8f31461d5ee8a1ba188a2374b7d04af7ae912

SHA256
226817045eeb20698d8f8126290213966d10269a37475a51eeb1b234639435ad

SHA512
07056d367c9c2287fcb97f5b06b39bbf0da9b99603d7d64965a82d19ffa11161c5082abddc33bd6c1b0117e4f1486a49edf1058298cf59e130c0c3c437af6f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5141618c759008b811bc294d03494bac

SHA1
df549f9ee779874f36a79bd9d16375172b6a3249

SHA256
540c89303274bebc023abc34c5b19a6974f9ff0d3b9522fdc7195ad6cbed45bc

SHA512
7a9b4bf98ee8b036926cf642a03a0fd7364be57e3080d17180a7c45b1c094193e60160c6579fcdc106a6792798bf179383a8730011ed99c8a2114ab5de59efd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
629d3aa445a20cb6049c10de7a35da27

SHA1
37bc60cb012b3b7b9ae63a79477f0d7aed904c02

SHA256
1683165a213b298230c2457bb5a9369fa6c7b6c4e45203cb1fe503c39eacace8

SHA512
7979f0d9ad7638fc7489d8af4195358e423e45c68884c60a35de2d3f82b4ff514a84107388e67a9f00118dccdfe227fd63a744edcf01cd9b26dfdce2473c22fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
99124fd88353450bae782171d4783269

SHA1
2b4f4a647e2711f03311121522cb7c9517a28a15

SHA256
3336455b31d5f2e55395b38b3c0e0b75ff641fe5c055718e03fd2c63aea81c4a

SHA512
707b88e5b296d8be49f83440a61a55602005252872572e105d480d249d3043bf32a0591097edc7676caa76060bd77caf51635f38543034e77c68b50ab552780c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dbdede2c4ae4594851a95d4b8129c310

SHA1
52c6d72d5d6662a7360083b7fccd8ae4c3c5a1f4

SHA256
990e3e7ac2ae20b84ae73da888bce87fe4313a4b835072f931d165c383ba2db2

SHA512
7bd7dd8dd5781cedab71f0d44c6306a104a478eae145ab031e76782efeca372095e4b0bef87b2e5c734ecec3ba44343f1b98de2ac56b821b491b39013689b642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587fd9.TMP

Filesize
1KB

MD5
6eda02cebf2f1f7b601627f174fd3b28

SHA1
944068fc1fc3081f4b617f9837e408fde9340110

SHA256
b600312cb48def42198c5f9dda10d0b007db162c79a36f84a8509384780ea709

SHA512
fe0868e22b1a89a6340f0a74e2a83d6eca9f8494bd9f9961053bfc920bcdff0eb42dee2e9d2c0acab913b61c840a3f4767b1caada7b63d0435668c0fe6653f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit