hxxps://drive[.]google[.]com/drive/u/1/folders/1iDmne6wCvkviZu8V8PUITjl3nzRb3sWe

Analysis

max time kernel
1800s
max time network
1729s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/u/1/folders/1iDmne6wCvkviZu8V8PUITjl3nzRb3sWe

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
2760	msedge.exe
2760	msedge.exe
3680	identity_helper.exe
3680	identity_helper.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 348	2760	msedge.exe	82
PID 2760 wrote to memory of 348	2760	msedge.exe	82
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 2656	2760	msedge.exe	83
PID 2760 wrote to memory of 1632	2760	msedge.exe	84
PID 2760 wrote to memory of 1632	2760	msedge.exe	84
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85
PID 2760 wrote to memory of 4900	2760	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/u/1/folders/1iDmne6wCvkviZu8V8PUITjl3nzRb3sWe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc13cc46f8,0x7ffc13cc4708,0x7ffc13cc4718
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5004409914187422384,17402916497993959527,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
18dbe7f4f5015fd7133cda029a19c884

SHA1
04a2e5cf750741965eef79a2543fa847204dfb3e

SHA256
0852331b25c689eaee42277466d9b07304fd50b323553d8679ee294f18ea6388

SHA512
98617c5882b5b10bb456a91f5fb931c86591e3368ff3e432ef26459d1eada55744ce478bb2c69898baa64d2e9ae594c809284faca46b6b81f66ac02daec6b9cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e6d41ab835a7cb26363c28c9cddddf87

SHA1
4b529756cd74e45164a3a407775c0f9cd3a7cfdc

SHA256
96ffad6894e0ba6c390e89a045e5d9eb5a4ec5801de3675abee3d4a270f599e9

SHA512
049c10ed823fd02ab1d3aa7fc15f1dbfb03bbc60c732da9078471612a2c4ccc3a03c15aea925c7a4dbe87e9e720835e14cc110403281d5e80d14a4ea6dcf5dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f6d8030be1b018a831ce5f08c8b04569

SHA1
953f9e06b15420dba86cdb1d8d2bde910f155625

SHA256
97ee460e5a56c3792aecef864f8595aa50c0110161ce57a40d226610fb2f2b99

SHA512
4c88ae16a0649acd6deabdc5a9269b16cc9dce9e9104690ccee6c36d8f51497c3c86f93361ffc2a8e4b8b9b03f68ef1e2deb2b11d5ac8cb272ed9f320044f31b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a77945df4c30e4d30466ddbe4d98e19f

SHA1
2ac111c35b50c7dd2c42f1ab2ba58258b2e0d150

SHA256
2cac483157d5e99b912cafc7c3e79d16dbf1ab8e606b556854527de4f3851122

SHA512
de8d3e42601d51c0f8bade68a8f3fa14cd84b84ffe724570ce5a88d38a305cc2c1bfd72204c89b9214929ada709292e7886da666c2218f455f39affc22467750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5f0f6186f4167d39a100d8ce6aed345c

SHA1
411b52c58fa4194a3da2a2d8f357ffa7d100f677

SHA256
3af206f3a29b6f57402c8618a445d5e60bacdecfcdd2ce22939475e1ee1c9867

SHA512
dcd2ddb0b8537fb1c9fdd6280a48ead90297468df63cb3cac29abab352e9e3c92f06fa2e377798ecd1a115a6e2cf8bdcd49891d3ed35b4b002f7134dfc139158

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d776b0b8aa5c565e7b892b144696821c

SHA1
084acc7a6ed2efb762f873ae6cbb952b6028c1bb

SHA256
c49affb2e3cd275cfa035939f8f0b91c8f11f7f283ab0cdc724d4e0aa0812671

SHA512
61ec5caf3d94209ca9a0006f4555bc7c7bd16ae6bbea35cb2a16bffe5c779ae3667e5a28bd6a3ca4aa550bedb811e4f82903b16f9d1d875cca44226098f7f04f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7e0a85e7f3cde2da9c8366b5f1ea54f7

SHA1
22d61537e67aca3acd09336d029e821838e3e824

SHA256
7b664fd451ea7660f7d508ee472bbc9d6be68f1eece48b80ab4b77731ec98ab9

SHA512
6213b44d292b88e94d353bd8477149726ba9f61db3f863789c09d5e384c941601b695b12b20a29aff5d6242c85428c579251a704c32e7e28285996fbb9d004d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2bd5b83f6dd874ab0dc286fb61cae88b

SHA1
fc339bc4ee33f073fec965e87e5e35535634ef7c

SHA256
240f27286f056ae344ea875c9f00697a93df7539dbbfbbffa67214756afb27ac

SHA512
630ab129a031ff8f999f0872737c0d3cd30d3b5be403aba34ed065373c76dc5cddb5764dca616a01f81f7f6217627e8242848f8f153246e8dfd31fdad26be5f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0729308ea4c74e4a5a9337c6a73a2927

SHA1
fc05a1fdcfd80c8523af31f58eff8bdbaf551aa3

SHA256
cf1b06ea304f8a1af95a094ad6cdc134824aa05913b2b1295679a27fc5a77991

SHA512
0a2b6d574b635195d8150ab210562e34fdaae958e4ed1e4424848d1db1a6ab9aa13448801c99fb84c5fda0436dff3bf4e9b081060fe47e91a3d30a32e654553c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a507f63b3effd49b29dab526eecc012d

SHA1
88f6f64e093db961e29232634a045134db363941

SHA256
515eb54ee953c6c8c49f5445732fc2dbe0c9cdefef900e464690be04752273cd

SHA512
d3ca75fa22f98654c1eedffd39b6d4f5f33a230d837de031a825cd6a5f4961409532133af401f8620bd6ba211c3997cd139930479e71aed855603ed38864ebfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
79f168b0c657da1b5cf4d98b62b17e1b

SHA1
f406e643d0bddbb86927980f44b52f0448b42a75

SHA256
bcde424035b6d62ff602c980627b9a4fe773e9fc96389694b2f61d9ae36eff72

SHA512
178640ee699355ec32db7bc182859230ebf9ef60504a5bc9bf6d1088e3e0432b59d1ac3cdd94413ceeeadd3283476e2ec0ae7412f269c6180500d5837f314bed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6f2e752de6cfe6dcd7ec43cb5e880b97

SHA1
1d245d0577682b5b57699aa2b35d04b94ef0d884

SHA256
7185825a5f9e7a2c4ae71937ad461313a36f6ddc0db1f9a3025ded9321bf838b

SHA512
7380bb588e54c2fca1cbd680acf1ec504c28ba38722e95d18fd89dece0fcfbddc8b34c10c6678e25f7ca1737f6f8dcd411ed61a960e42c7815e5f5446240c82e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fdf2e6ec1d15672f9eabc52e9ddec682

SHA1
f52fb5f383cbd7ba956d7e785ddd5b1a232b40a9

SHA256
e4245eea164de9eb081264f711b21f33ab8c09ed4930dea25d194a122a50490e

SHA512
ca3507ec7bffb745ff79ac4a7ec3f16af225afb2760510f277d087fb1aedd517f5ca6d948da530ba07a958d854dd7263359133f5e049d633df4db551776df306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cd5140e36568f98e4f6a04ce9bfc8313

SHA1
5bf35925d3c09d4474a70ac2eed4c9b3eada3599

SHA256
5b607bcaff0ec2c24de1aafa6c4dfd010aec0e591cb9c2ba8aafd86516cc1176

SHA512
2cf5d28faef95e7a55c0c454355a722a52f83643cc0272fb58204f38b09c8976a8c69497d3309354460cdcb264d9b06b5b74ac96883c96962cfb3fe89182ea88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a48d24ebd57c1f3318df5b8285972186

SHA1
c819d3cb65ebbcbad54a027c72174b0757b2c8f5

SHA256
cb858536d86e826fe6a96dc0e2dfc3e610ab6d0261cc1dd439e74256d2cb00e3

SHA512
59ed461c8057f7275bc77ce3e6112b25f215ff21599c4e3a1e496563431570c0b75c28b96c1f93f80fc8d30c5b4d02e890a3eb0a467625fbfd410989646dc016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
01ca7893d4c8cf66c4bf4e5175d846cb

SHA1
f77699e6318ad8b12a79604dda4f105f2ec4cf69

SHA256
1251bc7d185c5d5936c4e137ad58f84e4f65584c53f85a3c1a6d01f4aff71b1e

SHA512
1de3785dccb8c477724fccca5dc66e9910fa7db36869f30167557ade0a2a9c592bdc0a0743e2215ff1366adc676d89830e2b691291f6f22ab42924698f8cb0e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6a6b4d13c0b99f00fb37b40401b04157

SHA1
4a2ee7f8a0b99affdc93f2b3df0b0551f3ab6d83

SHA256
e8ce9c8a584d5078314487f62c770393dd7e150946e4332d41ecccae2610c337

SHA512
5c67bf24ac92e68c5a19b77ec100111e15b96da38e42de8c8e0336dc18c1df8b64871b3928a28e1e5452afc1f91ed6391d74fe32040a58e284bedac283c76a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
99fb17166941c5d6137af3f54d494b1b

SHA1
0e8e0d086c819cd8577851528401e58af04460b5

SHA256
c70e7cef7e84e8e72c02ec1843fdc8f72a6f6db4095267034e944c41ae9c3292

SHA512
39ce0dc103fc42a68c2ff2feface8b556b6d2f12b45fbce7265a75c12c8505d05dd0221cf9bb2a4d3b419dd88b955afdba469f60b3aa1b40ad7bda4c2bb0a781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2be8d8e74d26ed65d3945c256b6c202

SHA1
b269de2d8a5913f367b0c911e4c501d2d2d665a7

SHA256
e01ea8c38ae839e996770114d5a2c73bb271170ca33c12b882d5c25ad0083597

SHA512
a7cf8b74f527b18fbd2eaa76e02db94ccade77884d2d2bbc10a62fa98da70f2aa3354bad5db883fd426998d3d85ad070b7c7a403cb8f1e6dffdc204e35d4226c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba7fc40f6913b0c6a10dc9e705cbb7de

SHA1
42c7427424cb89f01fa6dc41f53914f06d128c45

SHA256
3bf678f4e8eadba3c22f3977b89e841cfc6adc94f1454fe078ea79411f1596f6

SHA512
8ceca79fefce95605a54acb6228ecbac95c427b195e987ef49e80ce4ae8033288a019d849b6d5f84ce77d87e849b628901f10e3bc38a4133f4e44b8e0fbac02c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a183a864257ac439c037ca2b4946c0e9

SHA1
e94ad3e58473c2455a68dd22cc7f151718a14c87

SHA256
ffb0c990ede68d7381e90e0b5ec578f60be7ef9cb6c982fb26abfac1bd7109df

SHA512
c0bd3646be83c5d585bcbb73234d83beda29f97a31ccc1d171c00890aec5edb66cfb4e90821e0649188ea27b081b8b17cc4c9a5518ae6f0f7bb53805a59acec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d201.TMP

Filesize
1KB

MD5
ee26e9f709f7891283d4e3bd4c3bec46

SHA1
03db56994fdf43cdce3b4da9ff8bb8fafa133f2d

SHA256
12b2bd5872ae4daf72340480ee9e721a855ffd6cf49f52a3a73710913b4b6d15

SHA512
6205fb97576d31bfc27e5c8e1352bb3b5c06a74b6752341e3edb2fdc90fa2f35ea898bde148278b40502069c196f1cd8030d4cf3733e8dac2652beb251283c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9809dc246f095cd5ed194ad18cd00d35

SHA1
7ddf288a784fbfb14e8e780e790796cbfbdcee7e

SHA256
867bb26a8c11941234668eaa4d38b2149042e9c2937130243fef771455ca9641

SHA512
c4d92d0730a63d0180ebed24ab2a3bc0ebd5fba9eafaebd2cae76efc78d79e5399c2397dd40939c9013388f8f483201aa81ca719fb7da09874d92b763dc6ff86

Download Submit