hxxps://drive[.]google[.]com/file/d/1e9SMmskNRhaEtr30qZorQai1PrFlKDMe/view?fbclid=PAAaZn66jQ8Bwt0pAeJxnf_vhG3pZTi1RuIXYWHQoV-zKh8rWX4HsxF0ylezU

Resubmissions

09/09/2024, 12:40

240909-pwdxxs1akf 6

09/09/2024, 12:32

240909-pqyedazfqb 6

09/09/2024, 12:23

240909-pkwnlaxejk 6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1e9SMmskNRhaEtr30qZorQai1PrFlKDMe/view?fbclid=PAAaZn66jQ8Bwt0pAeJxnf_vhG3pZTi1RuIXYWHQoV-zKh8rWX4HsxF0ylezU

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1356	msedge.exe
1356	msedge.exe
2580	identity_helper.exe
2580	identity_helper.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe
6020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 3624	1356	msedge.exe	85
PID 1356 wrote to memory of 3624	1356	msedge.exe	85
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1156	1356	msedge.exe	86
PID 1356 wrote to memory of 1264	1356	msedge.exe	87
PID 1356 wrote to memory of 1264	1356	msedge.exe	87
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88
PID 1356 wrote to memory of 2144	1356	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1e9SMmskNRhaEtr30qZorQai1PrFlKDMe/view?fbclid=PAAaZn66jQ8Bwt0pAeJxnf_vhG3pZTi1RuIXYWHQoV-zKh8rWX4HsxF0ylezU
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa06a46f8,0x7ffaa06a4708,0x7ffaa06a4718
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,5469354587243428143,7128352432512406541,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6508 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\28fe1ca0-ec76-4a42-8286-7834f1e0208c.tmp

Filesize
10KB

MD5
ca5be5a9c0538b43859ae50c2141b5ff

SHA1
2af7c19b160533bdbd8ed4064708275af0ffed1c

SHA256
3465f6c5fa01e8ff3459c27219f0c88fe34d8eba289b0be2b8bfea50ad3af15e

SHA512
78f47af10b4a1e605001c733ab813efe8f44c0784d8b74ee6836f0d7cd95745c771d1611ce045f115d33386ab06e21ebdedce8c3eacccfc3b6759490dc109a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
cb1c96e4dab8d183784ff542a22738f6

SHA1
e1aa90802768d35094cdf3196cf1cd0d7d8bbe2b

SHA256
99beedfd82a67ebfcb86d15310a5c712dca4de96dc415a6079c1bfe5263ac049

SHA512
41ff34cb1965d2f3b583c2a24bc349e68624c5e2b6be9f4568983c6e8833d3b808837a8fc7156f3cd3f132c4bc80325a82a76490c06234390363af37addaf23a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
57a4e75da9d72ad55dfa99b37938e158

SHA1
7b91f297e756e9286f01ed044c907db4b43f54d4

SHA256
5127347ab14cf53d01ab4723ff61ac21a5ef9f153cd334081853667c5a2fe5fd

SHA512
f92c8a75db3fac7c90f6b319bc70cf28772608eee7045ece44b3638c5c0f37f3c7e723361d4a1e755aa365ffb6ab14c32998b9974e5ef86b29b9dc3f6e4d365b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
05ca278c01a1845deccb93919180b1c4

SHA1
033a7eac85d8fdda940ba7a8b54dce0b2d0139fb

SHA256
de5cfd85ec91d3f5c8c31f31ff5540c448b19588a336a9f569f27b6800a93a5d

SHA512
2468b4692a3c47d483e4035c6fc8089bd77f38e0362b6f2176e88769f7b17f83fd05869d41ff0dd7bb0b5ce2c7b30e28d6f3a80f0c834f7e793daa42d4fa900c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af99fef045bd0cf8a01424234c98b252

SHA1
ee2edda5cfb1301fd087fcdae6743d9ebf73074e

SHA256
abdcbb9341e63ef9bff0f60be8e0abcb91d030c9e5bf5f793c574430dee186be

SHA512
9bd1a42f079b5aee20cc98b232b0a9f2dd7703dc0c213ba38bbc094b951938a5287a567a5590bf919740d9b0b8cc4ef97c5e7f55993348bfcbf30b456ec3796b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52a76536941919973c54dbf63edcb7bb

SHA1
e50d0384c1acdf1f13a6364c6c1ba1f85b124b33

SHA256
7e14c287cd4a4f6e80195c8900ce2df56f1d5a19448ba4c3bba20559a7074fd8

SHA512
e8fa9c692765f9b6a2ee7d7c74513f2c1efbdfa81ad0f446fe2912c2ce546d58fa135a86c46909a929000d5ec82c440b1e2d304a956121ba734f3855b836933f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bfff3497-0093-4133-b54c-965e458d26dd.tmp

Filesize
10KB

MD5
61e4b8bee4cdf985eca5fb58af71d873

SHA1
0ef5c5bc073ff802e061c97a149358ea17fadb9d

SHA256
178756c23f011777d494d639076aa954be9c03e606ac51129fcdb07eabef2049

SHA512
14b728ee1381552aa09d4c8ddc1dbbb32727f6c157b7e151454c1196341e3d2a841590142e411ac0cc3a1071bc633f5573d21071fe38c21da9ade0e492c36d56

Download Submit