hxxps://drive[.]google[.]com/file/d/15ps7HmCHZzK8PjZVbzguzaKrZ0mHzpuI/view?usp=sharing

Analysis

max time kernel
799s
max time network
801s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/15ps7HmCHZzK8PjZVbzguzaKrZ0mHzpuI/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
3324	msedge.exe
3324	msedge.exe
1812	identity_helper.exe
1812	identity_helper.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 540	3324	msedge.exe	83
PID 3324 wrote to memory of 540	3324	msedge.exe	83
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 220	3324	msedge.exe	84
PID 3324 wrote to memory of 4292	3324	msedge.exe	85
PID 3324 wrote to memory of 4292	3324	msedge.exe	85
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86
PID 3324 wrote to memory of 5052	3324	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/15ps7HmCHZzK8PjZVbzguzaKrZ0mHzpuI/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5a4546f8,0x7ffe5a454708,0x7ffe5a454718
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,11627763074654789504,2802885967162747995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
d1f7ddafca9c98ed4ef3947183b19cf7

SHA1
c5a7d182d6da836cf45c1b688718253698c2fd2f

SHA256
3119125a8cc1fb3338df3f3a04b98c848aa20793426fb18be2499c1af04ef005

SHA512
44dd6d557473e8800ded66e434ae7746d5f9174d98a406d1f73e2ef679a3d353d7d00aeb68f12ea8fc0b951eb826b996da1a75821dc955fbb80edc766187d529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e7ea85a019b7408c866c707f6c47092b

SHA1
1e70d63284dbffa69ec17055a7821853209c7fbd

SHA256
f80274db8c9e2ed7b1bea999fb674fe8a11eb4655151f9f26caec3d5bf847355

SHA512
1fd188b57328bd4ad4acabcba3e8ba7ef5681aa4607cfedcec13cc0bc7640b18b6336d6f3be2dba4c99a8dca1f8e03c32a135c368217ede61507eedab9dca485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4fb63ec692c368f8f4deae605ed7725b

SHA1
0a3c439ee3c87449315a540f272fd9bbe5bbdabc

SHA256
504201bb6fdb7f913ad5fdfb39040bd5046d7db5ce618a94205bc534e86d0975

SHA512
1f4e444299aba8ef6a8385ecfbee201b49f77fd5089e67615e6160802937413999401a9787c5205910d4bd38b41d7c21b57044b037366ad7e2120371d2a59892

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
93b1c0e50ad89c45101dc92433d3145c

SHA1
ac67c842b23373a29e279b389d65fc6871a7de21

SHA256
f25c28790092d127a4151fa7d6933c6d1dae213e9e3360f2a4b9422356417643

SHA512
2b2a300d98361b368fd0e16270923133947f62ee453caa1a244270c1297297d9a98ae3c45bbe4e56a389fbd27ec7014bdf22ea255f37ff9d3842e0757a70ad0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
39633dee63e4c3f911eff5fe441b5ae7

SHA1
101ee6bf9dbfa93ddf38c0bf7f477715b0eb370b

SHA256
bcba34ef1663ddbc76a31825bb1fd41ddc086e57526d94da1b23ca88897a430d

SHA512
cb0924145792048e4e7b9f34b8dfa2a02b7748ddb873b1b11c6546b4b14566e083b5e9baaa37a384a229ca6eca99ab162091616dbe5c5cb3a048cd4a6a496511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5df0473e2b871449f4b1edc3305ab85a

SHA1
307c52fec0238cb44072b7d7353cd9cef23e056f

SHA256
68ae8859c0699dc7c604a6f350fa088342fa246357c1f8fb7597c201f89d45a5

SHA512
a59158950bf832316d0cf21412e31ac4323276365ce3f15eccef4533ac1b4ed1bef4786f9655a55b9eeb0d172d8e72f4ac7a6eaca919495747ea714d32829a97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0172b55a35a52e0b56bdceb2ba4507e9

SHA1
c23b65e76ab1e8de182ca39627f931a85523c3cf

SHA256
2c7f1997a40bc1e669c4929510f6ebc816e0af79b2a911a843bd6565e2996eea

SHA512
71f84dfcf66e7ddf98320430d35faf8ec08f42b67289fe14f8e098394815f245333649e7f3b2bab422c85bb897df6b199ce5bc011235e5f0ce7c146c2843b5c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
321647cc01e6f2f83c309fa9bfc47405

SHA1
b125868b23849dd166122fd27d8d09ba27e4883e

SHA256
48033fb4ccd04d7df81df44f8c7ee4e86a39d291222fd61eb511c0900a29242d

SHA512
97d6c46cd1eca963e6be2e51e09625fc7cc780de19976b3894f89af3e6f41fd56e79b2f7e7efbd208fc269c11c0ad0ca65085a6ebccde64bdfe6ab9a53bff7ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b18c60e05d901af18b0c845511019295

SHA1
ba1436daf0b135f4dd0020c9b635d7ca6ad3a334

SHA256
96d6879f2e5f32774899fdec62463869fb3acb48f6dc8c0ec03988811a1355d3

SHA512
d2d3e0b04d1f608ab45c5edc51bc4a5f197fa8a5fa700553b3355e72ea34fb507097173717864d63c243b208d66e39849dcd1e85a265561d41a18521488ccdd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
23a9f86bb3a99ab4817d26ad4e679d02

SHA1
375259d36e54dd338a428a1ffc2d7a91684b8372

SHA256
c9be5f9c776cec35983dc50951473e81907a6ae218e447c13a836cfd8d7f2cfd

SHA512
6242fbbed64f525bc747fd7bcc919c1a1db1ba1e1f12bb8f00b7089ae85fd475600eb628ea071e6909fdea14a35f2d9c21b3f95c50a7c36e460d00feea18493d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33d4e60fd4a3480d2c77e8edada6ee15

SHA1
60c223b9a88a2f6579a30d017675bdeafb0205a0

SHA256
f081e5ae77b64a512995e56c81198e14ac65f9d41be0f2f1183b5664b5e3e626

SHA512
2608a0f7de5f4bb577eb2ee24e18ce3fc1b26921b5d9b4fc0c51f3128d422d7acabdfac9bddc2a8ef03d9ee5a8be710f12d0e6ac315633b29f3108f88333e96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9b4201bd6bea887efcfdec0fa311de0

SHA1
31f90421395c8adbcce527c8bef287b1613fceea

SHA256
16d223f8566759ed33d6b8980e32e1cff62fa9cbd3c3ecd429890a4d61276866

SHA512
253136c000202bec117c9f428a7db7e124f97ed4b13eb34c85fe4176bc3a9da2ae12f234e8a5bbad63031e0acecb6d8442942f65cf03208af4f3fed1576b8f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a7acf7e999ebadd8c976e51ad0f6f7a

SHA1
4ca8d865f7759011805c4876dac27a574687c51f

SHA256
819a67772f31199d6fc4458761243091ddb6aa7106d97341d422feac1d7a6140

SHA512
f86ad8c63de481687adcd9d098ecfb529eb5636e7a46cf2028196d5e9a7902724d4d13cf256cefc8868fda0e65a840b5c8ae57105cd1d08118f8859a2f0ee00e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c8599188d6c196e76d93eafcf5041e9

SHA1
aa6545f0a57c1a475c0031c8a020457e093fc572

SHA256
0c0548532f5a34dbdb70ee4f4117ea49b890ad7d1e7e5a81de2c653efec95cb3

SHA512
63b1cb09dfe658893d5503216b21bc29053b3b1d1fc9b7b8cd6be756ad5352245b33036771dafb18baba42d04518e0aaab85525a91a4965ecd90cb2f5765bd97

Download Submit