hxxps://drive[.]google[.]com/file/d/1V1ALChKwdws95wLEdcYb-a9qqSeS4fCv/view?usp=sharing

Analysis

max time kernel
689s
max time network
477s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1V1ALChKwdws95wLEdcYb-a9qqSeS4fCv/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2268	msedge.exe
2268	msedge.exe
2792	identity_helper.exe
2792	identity_helper.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4332	2268	msedge.exe	84
PID 2268 wrote to memory of 4332	2268	msedge.exe	84
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2476	2268	msedge.exe	85
PID 2268 wrote to memory of 2020	2268	msedge.exe	86
PID 2268 wrote to memory of 2020	2268	msedge.exe	86
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87
PID 2268 wrote to memory of 2996	2268	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1V1ALChKwdws95wLEdcYb-a9qqSeS4fCv/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1f6546f8,0x7ffb1f654708,0x7ffb1f654718
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,337080608346561483,12577518570456508647,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
a54e2ee032e3fd4931ea89a0b941eedb

SHA1
8117d501c08f73da4c6d855dd39926fe25730b23

SHA256
37a3db617fd45cb1da234fcc4787646f4d78043fda5ae488112ce298b5d20a80

SHA512
f24b982d865704f26cfa39a669bdcbca58b48a3e81ecc0d41d57f972809afdd0c449b32df84691d49fbcd429d0efdce18d589cf9e7cf51d3aa2cc84b1268596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
652f8d1991c184dc5ab4805da1651d20

SHA1
975bff3f1c44b246fe7d91b6c95d3c0f4a19f5fc

SHA256
3c583edcdfae954ff9ed16e73f9c38d4b00504c53963c48f9c088d7ad3b92163

SHA512
a92d02e294bfe96dd1a3c0001654373bf17c959d775796c6b6585434ef462536a4d60184fa0496d684576ee48228a1b013b66ec56bc47c8b2697b6d49323e6c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ed7fe1eec553fb44406d55bb9b1f9851

SHA1
e1d13163be0d9596c8c2fb9c70ff44d1bfb39042

SHA256
54e3db368b3370fcf5953502ed93c67ab214de8eb67006da6d3de7e662a8d943

SHA512
24e3966033f09ee5793395dfb6cc406476e6780348d22ff19e8cb0432b12e78a1c9342286273c1798b32df5615980f1e08af2caf59a282bfc39c0006af829412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
06f70208ffaf1136054c87352fc159de

SHA1
7e7ef0a815ee056db3a9d576385e707f578da3f1

SHA256
babc2f737311d5debd13ae860923b6752e0cae84281705dcfdaaf2d49ff2ddc9

SHA512
9264dff272cc4e3e01f674375f272b3581dd32ccfd2fc6e86efea44143e7191455a9f9769f10e3acb92f8f3269d13f3de800376b0a0cf396bc52b830308fd6b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
026394cee5eadcdc97410293c2524b92

SHA1
e2ee91a1d941f249eced69d9f74794b645ac5835

SHA256
9079f6a74e1cffb5945c430abf0597aa16882755bac355d41d7d3d25c0a859b2

SHA512
abc1116df7f2d4ba0b3a9b8360ec73b8c5ef714338136d2aa1f275b730b3f7ff5884ac00972cefcb3437b58d5481fb376ce86e20779bea3ef7b24d21a2bb6a63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
57b6f4a4de8e62fd98630ec34d757d20

SHA1
e58937fb8806d51b7c164b0e0f53487aae185236

SHA256
6000a45e6c0bf61d773528507a2ab3e2665f32048bd243e28bdce505657cba03

SHA512
554b34269d74de08b3e0d39add539c0e29f36703dd60a53892f9f849a686a9b0b3e04850a65db49317c25b27b8d86d58a7ea00f5b1b9790a840339ad90583b5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a4bf5cd2a7441e5f1d08c89fd58fd0fc

SHA1
62f65c0e7fe016a3ddf13da17cb42958de5e4050

SHA256
1ae711926b00c05bf62b63ed21567c5fa52266bd64ec1981a79b046984ed58ff

SHA512
037a769b1941ab2c25cb0969284131e054cbf2d6458c2149b114adfb474fadbb7069a70b7f5eae946e657f96618b997d18b6b80cf1dd94e7d2272c78db850a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d3e6db59fd6155255d76b304bd3e5d47

SHA1
19d8dfda9e1c4c62ee3e3fde0656065e634abafb

SHA256
588c6542e7ab431b48aa0e05390c688c9a25156f8cf840453adb5815b383d298

SHA512
4bb0ed548cd613d8e01316a349ee7d5bc9c3f159d96eb5db2f7765c44cbaea586e8432a18798003c04d6920fc5b867b13c8f339c6b0b71dc7f99f21a127efa5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5280dfa90a4c11fe7836aece6d777333

SHA1
a11e5165f85ebded9e9762d01961c626b2a4da8e

SHA256
748fbf4e847e9bcaa9a3a17c6e344651857f27c84d016441f2ef119a1440bbde

SHA512
841df7482c422f1cec4209bd3d894fce6ec567d71b2231f777eed40484178a63e4812fd9a0e57780bbfbe40431c0b628f277397320b214db40c0b6c9314f51c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b54eb939cd67b133a42982796ad11f41

SHA1
ee1305ec60015d77791d8c37a4f6b5698d5c3d55

SHA256
1ae4744884c6a2231726a06ddb8e6c9e68bf79325fcd3932cc1aa0936645386d

SHA512
e11f89a8e81f94ff2532ebbc7aec011c793fd0bb6c2b2611f4411045c7f8913ca7dde3d621d0b79b6a080ef075b610af7c6f133d916a0d4c2eff965e7909f760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e720bcc900886d00890f4dd78dabeab7

SHA1
48f379972f8416ccfe59115c6cbb32ecdb04892d

SHA256
8051cc3e354ddf0e802a849b12bdf676bc5372596177b7337557885cdee38fce

SHA512
1d1c98f48ac5735933b29f3d13ac2628a7a19572cfa5aea8842fa3ad0a18739f0dc65ca25da9bcbbaaa1daeb5ed949e1058f823b79b9826bc8c41f712e1cdf75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2078f413900807d04eb6145fcace89a

SHA1
d930572c5ffa67af1267103bc8a551b2523164b8

SHA256
4934e953de7ee2dbb148f91fea5517a0ed52b899413e3c74ad8c729c86cfa128

SHA512
0b014ad25f56dc16970a5b8b53029d8054022afa8020aab2a35ccce502f6f8ed8cbf139b17c70feca4c6a184255912c5f9554ea5c8c6000407a311ed8e81dff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c597817850eb30663e125cac25ab972

SHA1
cb9429b63bf9364831c4b243be83a6a34cc0ca19

SHA256
9e2ea33833dcb9c0ff20edee2d645bf5bbecff16cd434f14ff18be8764e84749

SHA512
8ab7159013527013c8a71a52d85566ead900882f56262da70e50508ff7771733d107fc0bcc3c875f96f3e53ba31dba0f4fd43dd5fb9eceaa7e2e983b9cd3e755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cede9e7eb58fbf9c30421d5debda8fba

SHA1
b07d87b43b79466bc453ce5d1e7da6083111e8e1

SHA256
636eb813c8c692f493ab2336d4d423d4f79948ae4d5b967161b65f172d75d6d5

SHA512
2c134dba621b3c19253f345f12431983e7144261514d256d8cacb8adb11ba74303c335e1a07088c582ac785311220ac03b3d10b386dc04c89bb764673b9aa0bb

Download Submit