hxxps://drive[.]google[.]com/file/d/1jM3wvJNhn1h8J2J8DqnWtakAOYJTx37T/view?usp=sharing

Analysis

max time kernel
1149s
max time network
1135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2024, 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1jM3wvJNhn1h8J2J8DqnWtakAOYJTx37T/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2092	msedge.exe
2092	msedge.exe
3592	identity_helper.exe
3592	identity_helper.exe
2196	msedge.exe
2196	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2268	2092	msedge.exe	83
PID 2092 wrote to memory of 2268	2092	msedge.exe	83
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 1240	2092	msedge.exe	84
PID 2092 wrote to memory of 2112	2092	msedge.exe	85
PID 2092 wrote to memory of 2112	2092	msedge.exe	85
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86
PID 2092 wrote to memory of 3784	2092	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1jM3wvJNhn1h8J2J8DqnWtakAOYJTx37T/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff80bd346f8,0x7ff80bd34708,0x7ff80bd34718
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,4249063091413015906,3916493804434497845,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
bd9ce4ab715ac450c288c647cdc0b3fa

SHA1
cae727dabc95150f18e26db161cb5ad7838ac044

SHA256
5e8a15ef1e6784249f66954b1c3abb32b5f934ff909261d2759819b9de31cf22

SHA512
a5610ec075627a1f34de2ee9705d334b5129512d5ef5c31a44b5097dac416caff317038487b11dd5c6bf784c0069e594563faa560114da297700acaf08245144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b5d2e5c8cb9fe51e382f1ea068d5f329

SHA1
aec4b5c9af4d2b882ba8ee7139ca46694a385f1c

SHA256
94faae45335f8f71426b09bc72200ee3a870e4f4bbe1c54d0245106384c4ec04

SHA512
ddbe604518a901e99c46dc3c77383d97e88e253eada647f55b50e7903d4a650d5fbe63642b708cf56fd66b101aa2ec2ce108930a51713255e087bc40ff594f57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e4623141d2beaf7231d383c470b44e30

SHA1
91c87d622251adcd72997465829dc26c8fc407e7

SHA256
6c8ae53f3d849c818d45ef816cbc7ef1adb4e8c0f69a6f2a3f18018867ba4852

SHA512
4cbb5a688a3cfabf2a93f072d0fe0eef9fbf5f09cd5e37ff7cc9ae16bf4b26e1fec2cff2ba9f17f0db0fd128df3639a930223a66fcde079cbf8f250b9b73ebcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f79ba80b3d388a81ddb23be5d90e3372

SHA1
ae653e2db61a918ceccfe1b41d64edf9283a151b

SHA256
30908c0ee975d1cc7c31c2b362a77c6f1b563d48e41000685fddbe216edcb0a7

SHA512
baa6e09ddf0e422dd8ad92c3a4670c748126f9292da3e22d6a112ab2783aeceda85ba23274d698fa0bd3630405b258d3384cdf1e1553af66f61a17d034b2e612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
59c4edfcb7633c7401719c98c9262fa8

SHA1
f17eb5813ede422966c5d497a67b53146a21cc44

SHA256
e85a76873e1338c60daff8aa93cbaa380950b98374605172df4238bf875475dc

SHA512
0980d6e99e6e2040d8cb8af8c1639a0b653c5be6f0236be133d1c2126aa75fe22d20f4ef5d99bdc859f6a272d72c4116720b45c5b382821ca0f4d934b1764142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
10dfa225838c768db50a2bb038704000

SHA1
447a27af1157686664ff370dcdf3e8772f934d29

SHA256
383ee9e7834c1f9cc82a55a0c30ce670fd3d658154c902b0efcf84888a8bd58a

SHA512
075af97102d9974701d5a65c7fef1aef4b8a6a943788b5840310fb6320be89088c399b404c0d263d60b30452cec86d41acfbb521a44937004d7c82a9c8d7e077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9e92a29c1937feb4201e2eecb0860a31

SHA1
8d2c168b06fb865ad23c441b6d10013af91ffd3f

SHA256
57ce3591077974e68b2134142507d2ea37fdb639c7008d0a3047d2d97b9d6920

SHA512
47ac7c0e8d430efaca188241ffe550c4dc052d619d8332f0e366f7ac6570e3fdd253d59c2344ee9df2620076609c15b1975edace49f5709dc83bb633f94d8ccd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d270d2d60baddca8428f2cce4c37554d

SHA1
829772637737021492e7f430d2051e70e9fc931c

SHA256
27d159145d5199c5335b4738bfeebf687e7b2cab166fe863a39979dd0577f16f

SHA512
b648f9e9fb4628f6357b92598022f748e15324e857ce56d0a1fee5ff92060f3fbf80cf97a3bfd7c739bb1063988384874ee7ded2fcde112795269840d3dd9d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
27d0fc859f885e1341e0ff4eb341e7eb

SHA1
0520141056e1a90b3f1c7ed1ca0e67a42cf443fa

SHA256
6580588cccc981e67b1b33de84fc69006c0708d8e0c61e66fdff339f704bcca8

SHA512
30df7c129f354971c916140353e53f1dfcb295cb8ed4358090215e7b8b7695d34bb77dbe0e36431987c9c3016b45721c92ee4cf36c9d93fb15ac7cbd2444a5b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
da338538c9b460fd13b9a08af6c05ccd

SHA1
ec26649e56a42ce1adff7aeeaa9347c3276e6d0b

SHA256
db82e7c4a89ff86424e551f750548c2af8ca0ee0b0aa22057512b642c33f649e

SHA512
891bce906642162e2383009f83bea3b37d04413b1ddad762b0b54b913699657af453ebb82500362b13e8aab8036a8bad0e095bddf36bce955f3279fdb93b78b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6cb6a393d2c59244f5fbada41093ff14

SHA1
b4fb17353a88ba5803dc07ea75644c1675f9da7b

SHA256
9ac80b949a656ecbfdc56fd940a89bd0b54e1f5e13bf192a1bf9a9f7b57bb51a

SHA512
7112498a2d48462ef31aeade09868d34520b8582de25a3105e469677a75843f4e1e2050317bcf0be8723cd1393f9957e8302b698302f24b892b28771ff66928a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
baf5266ea06a8701e5fdce059e624b1d

SHA1
4383ff785ed6e3181e03ee787c2cd8af316278d4

SHA256
c2af1600391b93236712a614a3ca73b8fb7d5281bce4de8a16ccc6ea242e91cd

SHA512
f1e4a8ec62c0f3409b175d9c3a3c9a70089d59d84550ca7b56dec956fd89ff1f1920ca333056b0c3155dd59ea4afa1645dc5149c692944b563ed4e4644d73d30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe1246084b8dbae70d2e454a672426c9

SHA1
30bf0fc69cabd9da2c851ec0ac9f92a6792bc324

SHA256
8cb9f3e8acf05f72dafadf8de82ea66ddeb103f72892c87828f9bb1dd575be0e

SHA512
46b28e84820f5226945dd98df5e0e14bf83f8263861bbdd0bdfe4f44281d4eb7cdc5a4ba2c7e8f9ede1c96b425b0f2dd14b5f1e5704cf4950080930129136788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9646f6ab5f282de611d4d68c025307a8

SHA1
2e0686befbef3c62791ad43c96ab9e346adbde36

SHA256
b189034b25c780ba7870d2422946f1f6a31a73b9fe097a73e3c692e6339208bd

SHA512
11d35618f7fe13d759965bdd6d7c3c1ba5bbdb04598fe23ff021288e0d108d1aa5d5aac51c8f71f4b6b74c42a3b513db36600d44e422964eb7ae467c8a284df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ba8b838af2a844e32f138d9013b06ca

SHA1
71c6ce769a94f0e4d85978aa287cc1a41bb1f4d8

SHA256
dcd1939ffe09343d397511c21d047c08815bbadb80a309cf0657e8131847b875

SHA512
07f1c363143eb0f136c188f19a57ff91f6a14bd916d55abcc66ad72e934de0113d48226f9549575e63938a2bf518fbac5e455f4d85919cf5d1a3374ab71038c9

Download Submit