hxxps://drive[.]google[.]com/file/d/1hQqgitmtYWM5jtt-ObklXOMJa-_Sd6ON/view?usp=drive_link

Analysis

max time kernel
1138s
max time network
1174s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1hQqgitmtYWM5jtt-ObklXOMJa-_Sd6ON/view?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
3220	msedge.exe
3220	msedge.exe
1944	identity_helper.exe
1944	identity_helper.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 4112	3220	msedge.exe	82
PID 3220 wrote to memory of 4112	3220	msedge.exe	82
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 3324	3220	msedge.exe	83
PID 3220 wrote to memory of 2344	3220	msedge.exe	84
PID 3220 wrote to memory of 2344	3220	msedge.exe	84
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85
PID 3220 wrote to memory of 3972	3220	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1hQqgitmtYWM5jtt-ObklXOMJa-_Sd6ON/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabc4646f8,0x7ffabc464708,0x7ffabc464718
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,9313842363510026499,18156604200850112113,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1372 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
e97a6af2107abdc32b31ae78249e2f6f

SHA1
7057da4d6fd8d0c1ab0508f8ce9a9c6f6400c86e

SHA256
bec80883b18fc284fde689351cd3208c936c3c97a3d71d0bb8c33ec5064eb145

SHA512
77aec4d345bb8d69e8f1309a37c0f821710936bd32b364993cdc3acc999fa95f6ebb44ee2cb0fb8dab264026b9b85f07b39f0c621305d75f5c49e308204b9fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b2e50245b0276c4474467830f55c19b8

SHA1
bdf434a92c213c6e9bb11391484e9c7350ccc35d

SHA256
2305b04ae9709fb0af7be50dea50b7fb8ba95ca2516b56ceb7fa60ebf14ad030

SHA512
ee33fce4c232973ae412c04ca33edff8c14779ec10b2348e9f0a4da81a2940960519117303d2c6b358764a1d578442862d5fc35151e509620f52ce9c0ff717dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9c475087f3fcf8ca2747634276691cd8

SHA1
e4ead27c0c4975fcc5809db839aafa14ac718ef0

SHA256
a934d4263022a19b13056275099ef7de67c1649c62475db7b48d7085f43f9841

SHA512
36e01da2fd9e17d4f95137a2c91279842450bca6472d5f1115bcbca5ae1bc386f5cb99ae503cb9672c5cd30ba4f9bc097030034125d46e7cc56e69b1af61dcad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bbf0021e3677c30bdd089fa362901425

SHA1
3603cde68364979a18ed32f465e38eb14748f62f

SHA256
a7768c91aeed15a7d35a8919c620c603fb52b9d15a6f7d19e4b2b4b51d3a99cb

SHA512
6db1af0af3f501dd96665d36356186a19d2c912afc029b112efc97457a465ac5afff3fadf6ae640338f68e236712d9ed6fcab9004b4892a4711ee1085bf506db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c4453af510d611f48eed904cd91d9dc7

SHA1
256420931afee925d815587f2ffc97dde92a159a

SHA256
828b6a49be820fb9a2faf56378b48af2932c4b2c41cafbdd4dfc3ed6e558baf7

SHA512
47156e898c7fc27c7424063ad8e4ca09152693fa96cbf16aea1abde89efc3f8e01d7a07dc59d85e19124d7ac71304ba81f52cc3d98e3f65171ee34d731b115f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0dfe131fdc56da8e1c2e879a629c0316

SHA1
d9781fcfbd787f107933379964dcb9fa017e9650

SHA256
125b69868ba26c9bca9392a22b471e5d8cdcd048da8874ca18fa2f21f9f3d42c

SHA512
4812e621e756187a7c489fdfcec503f4a030d3922f171e909d9487b5cbcb8048528b04db73fec717ee4301a92a8031669029615b9c0ec9a7254fc58c33423b28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
42243395ae4d9f7a1daf21ad64e81349

SHA1
1481878e820bd0f15c00c0d85fbbf1092dbddeb1

SHA256
ca549ecb7196bcfffd3d1fa2bba8306861543d66595d7bd7fba8c2ff0d992178

SHA512
fa515f5ac54efb3a9206f656def859f2cd98955d44970be48421f3ddeb04977f526b6fb371d131a25e682a33c6c0bc790e4002e1a33a8fad1c911bd84b83299f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1b12d8e5b2fd5e70bbe90aa721655f05

SHA1
4642907bb66e730f2dbed410562acdce0f7a77e6

SHA256
04f0e575155da6778416ecdc1e2b51e60214405d1317945376f504c1ba6871c4

SHA512
6646719a063376afbff30f264293a564f525656a1261831d3578431a611d1be09be2e5e6995fe8b817bf7cfab3ec1d30ddc59ea00531cf2a7c74b8237cbbf182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
77404b25075d9bcb30205042a0d2e968

SHA1
ac8042ea8dc255ce149f41c1ee103429e17d4185

SHA256
501c2c348509a44d783019bc3ecae55d48f7b6d823fba594c4dd23fbefbcb590

SHA512
d7500e76f41d15f5a04b3cd9cf34cf678f74c4fe19b8067f014d1b8f6e9ff808e8cba8250aac00da28becaa7e4a27d277f805f9fdfe38997d53f7ad796e3d4ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
880374abdbdb9b8af1271d60c0c59f1f

SHA1
02e8c2a8153a9e7c1cfc341683f868ef4b5df2fb

SHA256
e03539d4a66e6de9f344e3922e176224aedc0edb04ba1c6b983114a63b84f77b

SHA512
df54d58cc03af72ba0a287457955b608855f9a2d206b3434f9db2cbe8b175af673ff390dafe26ab25651f3eb098dec240d3efcd2bb0c3b6b585db909db7ef47d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1cf3e601047311088e641554934efd8f

SHA1
6dc88f95bd08e9908441d4f6a525db9b0d89046d

SHA256
da1876c984d9e5d65ab8c96adaa320ee987ec97334479b2bbc71f12fb275adb4

SHA512
fdce81aec07f87a6e2c881e46b891947b07a505af80d54b37115fa3610c156089a009b646a8b2ce12f47d31533424f7a5b0303149f7df8ba6902d6ce90dbd83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
24662021f6003c9be8788dad7c5917a1

SHA1
7ee93cdf3efd793bd31fe4adfbd10b690d5c5094

SHA256
2bdb93e762df83d2e1009c3e237802233f431964abb85836a95602efc6dede11

SHA512
5081e1a315ccea525866bd365d220a72595fd139b23ffd043a9a5bb28a5856bec5757a1807e0b83bd2023de222bbe2908f25dc731a15c8b58d071b6457706d16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
72e12e4f0cc149175198f3a16580a3b7

SHA1
dbcb689606b66afd477e90c026da3e7828a93f01

SHA256
4e3d51ee2be6b47ce7d43edc95fc99600cd79a34812804a4ba08937270d9f29a

SHA512
57afc749e8f163590bc90df82bc8bd4df97e68de76c7e6a32944d1f3b3bd7936cd9d7350651a87a4a884a1a29c5cf371cfe448ff2b0067f146f34307e3ae3601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
074c14a9b0eec1c6b3d3c2a8136c9af3

SHA1
dbba82c382e7914769541b384db895a2c949091f

SHA256
1f0e0ad2291f410d49ba54a0e63455890a6ffc54c5aa3041ea4caac666755287

SHA512
991c54ec2ec5a8d3a7a553a7af112940a51331537c98ed6c2ca35fc1749e9771e448ff3a20de6312eb89426b83e7217cef64fe4386c28ad395cd684d12649c92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f4d1f0542180495d6a3a150b966534a9

SHA1
deeaffa3c89dd617686f2b97a1f4e2f40de82cf5

SHA256
6753fdfbf3b339d46898c3875323d253054dde76707656b589083a6c9bc57a12

SHA512
8b627e8da9da46053ba08c84c5a28b692fb03c1fd4c45afda72d576f597f41a72e94ecf6f0961110b766e641bdc8f707432a0a1effd0affdec428ca5cc76e49a

Download Submit