hxxps://drive[.]google[.]com/file/d/1EIxVmw_03-EdzU3RVvT-lkel1fLFPgIU/view

Analysis

max time kernel
905s
max time network
906s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1EIxVmw_03-EdzU3RVvT-lkel1fLFPgIU/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
1340	msedge.exe
1340	msedge.exe
3580	identity_helper.exe
3580	identity_helper.exe
5700	msedge.exe
5700	msedge.exe
5700	msedge.exe
5700	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2844	1340	msedge.exe	83
PID 1340 wrote to memory of 2844	1340	msedge.exe	83
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 1248	1340	msedge.exe	84
PID 1340 wrote to memory of 3932	1340	msedge.exe	85
PID 1340 wrote to memory of 3932	1340	msedge.exe	85
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86
PID 1340 wrote to memory of 4296	1340	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1EIxVmw_03-EdzU3RVvT-lkel1fLFPgIU/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9acfe46f8,0x7ff9acfe4708,0x7ff9acfe4718
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4124 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,5490010646222376060,13739393845055644806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
66ced6b8e44b61fb35d3c09fafecd6b5

SHA1
8c0bf530afc903240b9afd19c22c4044ec0b4355

SHA256
1ec460c291692496655f782e287afd14005f5321a2e62f109a613b7afab5a07b

SHA512
47e95cfd6cefa41a0a924d80b1456aaf575a970278afd9ed11e58ec80dbf935b78548d889b74add46e12e776099e7c77b9a5a3620f0f49cae053fbc1426fb48f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6927229d9ce671a56f957fc0eec40e10

SHA1
9d769fcf5401530291db4ab2bd2c8b36d21b5aa0

SHA256
213b9d752f9b76d19b7f818014b2efbf6d5ef57aabf69751c4bea3bc82c04987

SHA512
70cbacdbd64d674abc6820d87c98144b53266322a74e49619a93363f8c285c5d07e7759aec5bc944e01f2987c0098021f123a33fafb78d9c1da2f6c6339ba699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9ad5cdad4a3c5b234bec99048787fee6

SHA1
b5c75230492d86a6114b6b8bca1b0d3785a04f37

SHA256
cc0f2a60bdabcf6b1d0f6d5e0a3cd650e828f9aaf18f7cbbc6091a2536c89969

SHA512
426175b18a4f795ffa08e05edf1f5ed0d267d5e0a28ab4a1e69f2e1fbf596adb959117d19dd2606cbd67e083db112933fbb5dd93eded6424c073777ab9e2869e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
96c1a44877649d5887a5bfc0a0692f59

SHA1
879acd9705486fe4f839e7690728b79148eed7ba

SHA256
9cd659edf67ccf84e5991b9406e88eebe29ceba84e9f64816f070d667a037fea

SHA512
1c92086248747c2e1c426af0abfd18e91cb50f5b9e2528551c0489cd51713a7d3b5e649db0e23a7547f6b1ea7a7efb31d682451572da1c06adf021f3e0fc6c09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
257c82f23e80d3ba502d30f966e6d7e1

SHA1
e5da8c1b53fc1688471e912624163db11530df60

SHA256
110da903178c5920d65a77267f76aac2345737d9a79af1aeb364b82fb66453ed

SHA512
22a8972ee5ab0540858da7ae1936af142efe474c99bdcb93e23bb7d804a3ddd6bf35b855e701f30ec87746492b3e3bf662fafb4dcd5d2fd647f1094b13bbee81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6c8ab96d140b9faa2375c139375809de

SHA1
14ddcc4b8476ba5442fede054e9d077b6b9edad7

SHA256
f6caea27670ee7565bd481d6c2d121fe2c57a678dbdbdd9b9bf3e6c6673c6da5

SHA512
3e8000dd6a882b223575c0ba819565e64225078c9b99ce54e704b61664d5811236ff555a62b151b6dcbb2ae0765eb983de8268df1ee80a0951af54221b11e73f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8205a2bcddee62dc476479be8119acf1

SHA1
e232d242e9e9e53647b778994259f8173527e328

SHA256
6dd57c1fa4031fb1dfa1746616891a067bc1743526539f979810b97896739068

SHA512
dd7b446565ff8598f1c1d3aebfb99a752aac14f1eaf9992fc86eae2f3784126031ab8030bb0f72196de982b5dd70ce4405bcfbe5648c24e7d8687cdb2c940dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ef6855e14cc7ea7f4ab8ad6c0b436261

SHA1
9cca423d7ba2851d4519296ad35de8db9ec67737

SHA256
8cb6b4a7be70af58059f5bcfa6d128b8634ce70e2c19dde3621126fe7f2d23b1

SHA512
560c8d08e2f68236767622fad4a555f726c14530188dc37e66d1708878c45b0b18c16db63b5e6d7cb5519380f29d0998c43c4bd34b625b91532e29f2dc673d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2e62858d695d3fb3eca5d1e327ae83c4

SHA1
1ed44199ece4b685b39e30c9025e2044f1c946fb

SHA256
b986b9596f57feb0d1a17e5ab6d5ab2e059acdb091af1a2155d05550b4c9ad7b

SHA512
911e95aac7be800c691c662415428ca2c09b0a7f69223e5e06441eb97b408244f3b10b30e4763ee89fb373d6bc1008862a5f1ecd327e761b24100031a2fff5ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
754faf2812edd19f329dfccdd43b1a75

SHA1
ad5701a2299a16fa2ec7cb040d254e482050596f

SHA256
927ca588514f9918e48bc1df6e6cd19c9044e579c28c6bdef0ee6ce99d0645d5

SHA512
d1dbef085bc01a8a25db8df68af33df006e24d63e7f12dae736a7b5f0a1b29286f0eaa548fd528e13dc8a11bae955ce29081808d2b03d746d6b42f3b6bf5f24f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1a8737db3d57d6243a71649d3ee1ecfe

SHA1
c538bfafacce36a0ace823c953ccf09fc17873fa

SHA256
053af90de3e1b9b86dd04311d533648cc43cec07ad1d09249283fdb32c5ffbcc

SHA512
dba0948203b060806aeb48c53629a482544d723f81908586bb3819a9c67916b5595c9f9d01dd95aa61c0805e9d49cb80b991d37fb388a09eda13d691daa9794d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3dc7d87da321503d57f793d763aab43d

SHA1
6c1331f8b1ffd2db00794e80b5742e6085698220

SHA256
be744f3fb2cc3e0675624b5e77cf517a7ce344a39e988452a7660aa14619c895

SHA512
4c0dfc7c875a7b246d07bb4c4e559e266e3f792e564f77a76e479fde84cade8fada3cb716eee0a3304be2382d2085fe6ec25bf202b4d91177eef1b6784c3f221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d08e70902dba105f2b6977aebdd45740

SHA1
cb25a94cdc3b5de4edfbca09b6e6c038c612fb1b

SHA256
4bac368e275c0d9b8b475d79dbbfe34116cb9f3748479d4f02a0bbea09c61dfa

SHA512
91cb322b2069cbd57edbab3a09627f8a4d3c4b39ca4440216103ad7230a2b569318ada6a9d44b43a0c1504eb57404df08b4edf7d8d45fc31ba228d2fb654a6b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f5c68aa076ce87d39524aaaf526c065

SHA1
b07a08b2ec73efe6fd11e9e5e4238e9dc39d281f

SHA256
4ec7798a71afa9985e6a60bd56b24e04b0990aae1b472d716900bf2fafcf6603

SHA512
9ba40a56d5301f532e175597d0c747f07aec68a6ad551ae33e026b68721a4832b5566f87522a71496b5d75e9d7d6c812a07bb0311f3b78d3e64e712b75ece40b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c5d5053f5bf977ab51da0ffcc0d87311

SHA1
ac543500674619e99399ea614ce8e1df23e7944a

SHA256
73b94e69dcf35493defedeb05b523b835ed237e23813117e78f0a1f0c0b004b0

SHA512
197a9a2a85372f2a705d9f696ffbb4d50cb0bcad4a026ebfd74d3b414a47c993e8afcba1f7c3902048e96bf6fe86ae1e19d2a5d791c1dc16564a1607b0db702b

Download Submit