hxxps://drive[.]google[.]com/file/d/1nant0JWgN-23O8zk310TPSZCkKY_f_iV/view?usp=gmail

Analysis

max time kernel
1166s
max time network
1168s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
06-12-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1nant0JWgN-23O8zk310TPSZCkKY_f_iV/view?usp=gmail

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
7	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
2280	msedge.exe
2280	msedge.exe
756	identity_helper.exe
756	identity_helper.exe
3008	msedge.exe
3008	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3428	2280	msedge.exe	78
PID 2280 wrote to memory of 3428	2280	msedge.exe	78
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3420	2280	msedge.exe	79
PID 2280 wrote to memory of 3432	2280	msedge.exe	80
PID 2280 wrote to memory of 3432	2280	msedge.exe	80
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81
PID 2280 wrote to memory of 932	2280	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1nant0JWgN-23O8zk310TPSZCkKY_f_iV/view?usp=gmail
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff96bc3cb8,0x7fff96bc3cc8,0x7fff96bc3cd8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,4362016246503443024,13815369045444651281,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5592 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
89745905fa323685d77f1b13f61ea234

SHA1
7d45dca75d047cb99733de762c913c0ca3df609f

SHA256
01d21f936a767016e68ab24879969a2cd28ecc09d0c8aef85b0cee912886b98c

SHA512
94452540871ed524ad567f3aec16944762ddf46000b85769339a4d16bcf7ef8ee07028e37ee1ac349171a402490f07d5c8a4405505c85ea9dbdfcd251122bb92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0f903b877aec53f1f0261daf1fe7438e

SHA1
0fb0ecd9af978c09216e336aeaa7ba62fee3bc7b

SHA256
a12e41fc57ae91baf681e8f8b93586e50cace58694e1278e79d6e2875c0e8220

SHA512
806fa1a347e91919e3f24640df0343951257e5bc0a6674d6d73df576d872dcb99e503856ca7c2eb3c0abca7230f01691aab23de25284facbda746abb86997833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
165e1d5183b64458fcac9e59aaa8b5a5

SHA1
b67a466aacf017915859769a9645684aed5b1c6f

SHA256
47889e3708eeda9051844f91f687120edf92428f664ce15d0548bcbdd0bf5643

SHA512
0ac4da8084ff6c5543d976b41791bab362b16071d3afdd9d7c09fec1ae9df19970d90849066a02d1c105b6d4ccee6935b9670a10f369ab5d2a6bd4cfdbceff0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5b859b154081555132f5101015a8ff2d

SHA1
2b940d843f686e78cdde633583081d69f7f1425d

SHA256
aa89eca5c4666c205db60dcd659c6c4ccd37154b45a3593639b569ef68da4ecf

SHA512
32f2bad8ba4f0207b89c5ca8f645de3dc6ab1b75503488beb37a4ab1e5020e481b9da264b76c1110fb832cbb84adac4101c0097d946dd5873b8035737327ec8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
71f526d372d826ad1484eb62063f0954

SHA1
36f9ad062660eb563a6f83d84e157a030e513342

SHA256
fb8d7ec5ff5e6856afd8d10f7e35400ebc0834df5dbf761d2e0c1a3fa1267aad

SHA512
b5199937afb826ae08be3dc1058ba145f3f8e48f76c8d17e10f124db02482d1c46a3a0eebffe6e5398e67bdfed47bac0114fb4ecb2205bd46e1c41e69f0cb300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d6e4c3a3fb310034f19a09f5ea08574f

SHA1
bfe567989f34d3384657cc9291991678b1f7015c

SHA256
a3dee02c071cb6e2571f4ea12545c94cd0f0329d0f39143e9a305674f9d79e68

SHA512
1b770c571f55c1961b44acc58d73b89ee4374cfc7c6f23eae47d17d7144bdf0d02c499662ba6c42f2cd474fb0a014b7a5c59934e9652187bc0f182fc2a41712a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
29133dce3a3efe6118ad964134aff4cb

SHA1
c05812329bd5e7ae5cec175026cad91bd42713b7

SHA256
6c421d93a0546b8ea677a9f071d92b159bda21bc4944c880f90b9ab90371f503

SHA512
fd9a69f2aa6bdca6d8abfd922a5c73ed87029af29b0b514daeab2351cb08134b6e2a0fbbd37737f1d0e9fb0c7bbc24b3fe850f5206588814fde10e6be87b2ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
89cbd8289be75ac2c77ccc09b55b4953

SHA1
d0b6946b6a10de6d035a4e18412adf1be56ae0bf

SHA256
e5e3945b82654af3bfef71290c864f01062b3e5da04de21a627df10c1e203a3d

SHA512
b83ea5a4b2d89f4d6dd69ca91a32e79d80b2e04e1905761ecb4c32d55b699c84e1a9a0f89b968b5a52f642226b1b294ba8a3137144484d678ca9982b1e2418b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2318523fb8bcc8466f9db9218d1a629d

SHA1
616dfc08d648973a7bc746fb2038fc312859f903

SHA256
9aa9b4141fb24e2cdda232aa5ee5a171e5302f9b169fef051d1ad196da55b64d

SHA512
3af00cc75c3d6cf9a79d831c0bb62294bc5775811b19f596ff1e37622fdfd6417b6f6c2ae32e30241035d37562c838a125fa973b69a82ad5e3d8e4757677997d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c17bf20e30e58a4f7bf0e888608f1b3c

SHA1
d4b4b054da3c0e0131d55e89426a3c2acb1b82d3

SHA256
9be58821fd91c4e29cf282b4ad0739ec5bbb752de55e885de48827fb95d37b99

SHA512
caf6dba80808677983ae2a7bfdb701e655d1aa1c285bd3ac60d20bf6545cd80e650a8855bcccdc5e92596a958d7b3733abc5b2e5893f4ee0689b1a797b7cf8e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ae8e566ed67126f097670dd7eb3fab7e

SHA1
7d2ed826c39aaf3a0adca3de4026c6f3fd49c97b

SHA256
b010068046a9913b3aa69989bd23a8bfc0e2c040ad107c1199f199926bfcad63

SHA512
c10911de2757422260f0cbfbf99187f43389c3e2fbc1ee627955cdbe08dd577333ac2a0e7a2c042052713fc96bdc803e4638a3565337f9a68bce17cc02bd8d9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
98ba0ed527e52102b0650a8f21fa0aa6

SHA1
5b71cee68395711a7aa663082f2053bed14a673d

SHA256
f3c72d6dcc2f1892a639c982fdcabca8425622a9eacbbf1d177eecc9e5afd1f2

SHA512
ce4ab1487be4aeef7e7e41a46e4c6310f5668156d4c106c0605aebe28ab8acb8355c93a6d37def5f7717a2b5f25ff0a165603e436cafa8de94e736acb7adfe32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2e4be98d859ca514485665c21333d4d2

SHA1
d558dc3f95f99afbba1393d6b7a20dec90ab7865

SHA256
f8148dee216ba83ac9c57531fd92471c5191ac6d645b9ee78473e62642378b9b

SHA512
e20d9fafcdeb5de1e4c894175bd960b202be467fa3c50931aa24b606a691acdf1d06f9b88ee0c9cb6c54bc02edbfa10dcdd8d8a301dad76a737023b11b22b420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a102a1bb1a9f33f5e59d8dadd6539928

SHA1
f5273b9098e07252c98e4b29ccc9cf91fa657608

SHA256
fdeb6332515c334ba87abbffb7ef09b50d7ce7c235e805d5e943f582b8babed0

SHA512
1d9ed748e9b7b0ef27dde86b2f5e834f4e05d278969ada9a3fd8ceaf967de27f9d761cf587493cf36ac702738b88175fe97f15167746b42c89c5976c5f1d482d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e4686e3be3d0678db6c5fdfd7544e99f

SHA1
96baa7c209c49d7d7d115d400b762425eec1825b

SHA256
d41eaf7e84fe2d42bafbe2d8dd76c40fdd7a865fcc570c10283f2841a4cf14d6

SHA512
38bc6ad1bcb20855204840256bc4eba401326f811a8243d2154f47c74f7385a0dac2d344fcd10f7e90c8d22c20be789a2d16dd1ac6096e7fb327e0565dddafd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e0f10649410a2124d95699712fef412f

SHA1
9df6875f562554cf5ebaff2ef1ff315ebcff31b5

SHA256
205b3061d6f523491a255a5151240a3a672ec0203ca196ee0c5e3d198492b9e1

SHA512
196e654c6b71a848a0b1442ac6307569bbe49df8f0022ae04d69f7ca32a9447e8de21f226b40b8a8a57c83221a442bcb9dd0da4d0724b81bfeab7265340d7fb2

Download Submit