hxxps://drive[.]google[.]com/file/d/1C09te51RlEZ4rB0kK3M_GViG0cvgL1-4/view

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1C09te51RlEZ4rB0kK3M_GViG0cvgL1-4/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
3984	msedge.exe
3984	msedge.exe
4620	identity_helper.exe
4620	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 1848	3984	msedge.exe	84
PID 3984 wrote to memory of 1848	3984	msedge.exe	84
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2448	3984	msedge.exe	85
PID 3984 wrote to memory of 2904	3984	msedge.exe	86
PID 3984 wrote to memory of 2904	3984	msedge.exe	86
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87
PID 3984 wrote to memory of 5084	3984	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1C09te51RlEZ4rB0kK3M_GViG0cvgL1-4/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe649f46f8,0x7ffe649f4708,0x7ffe649f4718
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2740 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4574486680547167476,159070443573776151,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
a29bdd1adaf5d843a514ffb5063aa0f7

SHA1
01c8e82a31b4e8cbc083c8d18d4ab7aaf5fc320b

SHA256
1513c30e340a7c8e34a4a66e543a99501c57dd82ac25cc38fb7908a2e090f3c7

SHA512
86d79fc310b9ce6084b177be1ce7c72d136b2d3a0e5d5b443cd1510f94513a3ce3502e3c3b86f5e6802a1cf64d122c67af124b798ff81230a0877f7935570376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
251e12642549949ae66a9c62ee2d0b3d

SHA1
3c33c06b8a2acddf2ec378fb71d7c7f8b6264fb2

SHA256
e0f5ad9adf9f5dbc2aef48a920c8294a28c32afc357fbbfb02218af41a9e45ac

SHA512
6ddec264abd02f27d25f1db71d41e66edf01bca01fa6af4d7cceccc00928f4d462ef780c778694671e0abf7bffe3aa8856265317de3bf78c0aca6e202427ee1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
260cf55957bee8060afc2039179d30ce

SHA1
ae7c5ec0cf86bf2a07428edd656551810c44d3de

SHA256
21944cca3400d6718a881c945efa9e5b5115351fd98c3ecced1720dc5fdf08df

SHA512
6040909e528c873d00cee47eaa9b8198e86fc9477e3506cf880d712ad16ca767736b09ff053b6537cba4f1a7740ce8a599a161f9dba3e0f4c75b31136b893be6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
1f9ab167b6991ff0ff2f137842be2e1c

SHA1
c0ecd6ec54f70da3076aab7524d0978c648dae7a

SHA256
45d08f24ec3896e8b5580985570509a279e5ec14a1f28a6c9d2c8401d1d46f74

SHA512
faba9b27d8a963f37fae279259e076ebf5f1bddd2136a1604716c8096de977ccc60fa5c1d99987b21e425675714d198cf1b467b288846870e6c00e7a9b74700b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c1b24362e2cd46696469e90e59fac2d

SHA1
4d90ecd9cf4a475a1027e465e62b18a155448051

SHA256
6e546f04345e779a43a90a423634a69ac73a44f055d8b9ee6349e13c4c9997c2

SHA512
425710046f58a5503608c3a5bad8476acee8bc1356e6cdd64efb1318101b232ea38a3790bf9eb3fd77efa1e7137d4649c6ad26c65e775273e08aa33f6951f870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ba61fadcea4180349c7695f67e64b7c4

SHA1
e7e9cf0888ff53c396a3ce3208c445a8457f6ee9

SHA256
bd0121f9ea8c75fc6f24bf3792fff23936558c4ff78490a3441dcc2aa7c71dd1

SHA512
d71a6054aa7e062cacd47fbc7f23f5c92c38760e04dda0975e912278265b764bd85d9644df319b613173c8e74f02238404a27311c8226cdbb4b7c043073dd7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cd52e6176863b834532af09ab0ce3d3e

SHA1
c8c88b0ce93fadba2db7c41999daffd13e831661

SHA256
8869ff44e250588364929100a022e23a60b6f5b62735c323d285f9108674b7ef

SHA512
abd5cbb1bff825fb5b0225ec2c68efb2e0759db7f8efd97417a85d8b56ac4714f38ea10cddaeaf43e041a039bf55af2b1b8d9892fb324299503c29862f4be4b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9e768a014456fea57d998be6dc08984d

SHA1
c4105a606cc90e3d3b5e5c73d6069d6720368b6b

SHA256
f6cc2f017177cf582e6f12dcf968b17693569c2021c09cf8a724af0b68517d90

SHA512
e0176d415e32cf0c2845d61bfd36a5a983f383cce98ec6c67e123acc06bbcb7645a5e75507564279b008f4d60597183cf190709cfd3aca4e0c53c7115ddeeb52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586b09.TMP

Filesize
1KB

MD5
7e7bddd298efe9424464942452d44553

SHA1
027e801c6585c3004ba89a08a062afd7c686ae89

SHA256
cf14d2309c3bfa048a052dd48621e04993cf5a3dff74b91712a68367837fd7df

SHA512
7dfb4fed15dbb6dda66970738a6c4e1ada291c9c0eb9951c77e44174c84da6babe3b507328e5ff9394203aeef92d76ed7d8c078830e9b4252c503dc0f34cdc6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c964c5e2d46487c5c6cb3fdbf7363e01

SHA1
f4eff890ea23a9a917cce573cdc4ccc004f6ea3c

SHA256
053c6cae0235abd3d9552f077c83cbf92a79edbdc2de1413f6c63e7022f84363

SHA512
346eb5323f2c86e83d947479593f4771284cd09d29da107245812e9d2ce4d647f84edcd84b0bb0d647ad33e56ab5db35bbb255bded3704dda228a825c6de9e4f

Download Submit