hxxps://drive[.]google[.]com/file/d/19QBwwskMHW0huFd_S1xlXQ2ySqK76b6p/view

Analysis

max time kernel
1148s
max time network
1151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/19QBwwskMHW0huFd_S1xlXQ2ySqK76b6p/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
9	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
2236	msedge.exe
2236	msedge.exe
4268	identity_helper.exe
4268	identity_helper.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4656	2236	msedge.exe	82
PID 2236 wrote to memory of 4656	2236	msedge.exe	82
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4056	2236	msedge.exe	83
PID 2236 wrote to memory of 4428	2236	msedge.exe	84
PID 2236 wrote to memory of 4428	2236	msedge.exe	84
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85
PID 2236 wrote to memory of 1792	2236	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/19QBwwskMHW0huFd_S1xlXQ2ySqK76b6p/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9396046f8,0x7ff939604708,0x7ff939604718
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14269690307588201242,4364574847324647234,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
be92b75de37b64f6400c775614a27857

SHA1
5bbd48b929104754973761b61c7c1a8300203a99

SHA256
22d6c017952c8d130bd7a23658838dae599275b6ebb88b8b8b7f9364bc237b8c

SHA512
107194a13abd20a18622b5870420ab6c4422c9bdd8b63203d13b188be0ace28ad26d00aa2640407281b663b4df214b436610de8b80d5fdd08c3217579d1d0cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
02c6022a1fc4fe9b1594a808e0aa0ab3

SHA1
e5c1d54a867bb2e13fa5b7896b15593ce2688f55

SHA256
6d5537015dc00dac8b0880ee2a8bf33dee03a42d4c12de4dd6f12ce641099358

SHA512
2ab6d167146133900b9958af73c558fe97246506ff91cb916bcb5a74a5f13fd375211b1964e5c12fd717928ac7918ab15cb31cb73f512ae358a9405d2f93e5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
23d22c16cba68da77aaf9e6d27583fd7

SHA1
2c25d8477a4550f8e910b7eb95f42f89980192d1

SHA256
957e374a1002f455e134a12e94dfd8482bbdec99189489c4312583eeb7e8b9bf

SHA512
cd7f111bcb1ff32c6d95a65052ab2f8e185e48bbdc89f163a527f459b2c45b2b3db670e26b239be1f1c3138ff955259819c3effa41df94f21c4c77a7c7936ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fa5939777e3e3bf0bdfca64ccf17c2ca

SHA1
20bfbb32e56954d9ab352894ec827240ff65e17c

SHA256
d77520346ce329cc3077b40ec89e872462c6acdf4f500444ffbcfdbe36fda0a5

SHA512
3d3be6bfb0a775a186487e5417488a8cc7a86311bddd5b7a507dc60c4618e6d4ebcbf18f990f61a84bbe6662be66a2f11d97c7dd27eb543db2eea603872715ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bd9a757c1e3f37d6a36346b8961162fd

SHA1
eaf8cd92cf2b139de3b95f26b4423c49da5ca23d

SHA256
ef7a46bdd3108accb65a280457847ac70d8f4db38de7b8281243906b58779245

SHA512
1e4d24efb87cdb1a5b6491b246411c527c11eb73eccf314194c832e2111700955acbec74c221da0205eb3cacdf6aebaea799003c77222c8ca406ab89d374e5d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a3b79508f8df83b065bab7fec2f490c4

SHA1
c5aa6896e9edace7e356a46dc84526ef76f7823f

SHA256
75f2065e8f531c747c7e253a582ded2fdaf692c3171313a19fdaacb6ac14f36a

SHA512
cb01aecb54221c74634c63c3ba92ca962b8ba58835626c4ee8ae9f01b1957efdc8cfacd56d233a4f86f4f042d8fc8e64c0c4dbbe75ac022c5ddfb832b6409c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ef0c6b2fb5c0c2efa9b753da7cf4103b

SHA1
54bb747aeb195ea7b866452c2e4543c82bfb5241

SHA256
41a21d6db1a65fe6793db07f1dd594a9c050eb8f5a6706f9ac15c8e198e9e607

SHA512
5691535ee032acae2e53d10890aa10b70302d64b59c3f5a860a26c541644b4e2a8cc16404203c910b27a2241443d44d2216137419d9c623f69c2ced6845487de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
409d5c0adb0e1b48a672de968c34d440

SHA1
450c78485e481e5af0aa2d5430f6627d45ddb13e

SHA256
f8e867809daff657292acf4b3c15584729e37c698d293099925bebf1c2fcb3d7

SHA512
0ed5b37da1c7ac179ee36087cb88ca05714bcf86122aa594d56f79ddaa3fe58fc4b5bbab50f70a58a2aa3f1d4e326f5ea57d0aa3ad8672cbd268dca55f8a08b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4ef552649739d96dd47fd76178289aca

SHA1
429beea71a02226e0861dcbe8a2c2925ec04119e

SHA256
bef6726960af124e4d11f00e95b85c0b649cf308b7105336420110e1bfc576a4

SHA512
15fb8650510531d4cb91726fccefca890d315134c62985f30e8000ad69b8bfa08387d02fc1c4b70d1b72adcd287ab655020ac56e9417de0a2b24840a98a099cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7a21ccd5f7a9fae7bc911beb8af17d4b

SHA1
87bdd119cd4798ad16e346af5e67180d60a81c58

SHA256
257bb47ac0d5ba0385a5e0090ddac5c267e872eaa5df3330ec1e5e59cc5db9f4

SHA512
4edf982e00ca606b61988cf952ddb9b61168ab9dd11a05bf0a60e85a463b4f99811dc5c66df3623f00bb9fab0b6b089ee890bc8bc33eda6bef756951efdcd49c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5ab1f54cb487da3df32a23d483825a20

SHA1
035ab460ff5868e92cac4d413bb721474f68a1a4

SHA256
fa50fcce46e90ea9f2bd4c09578ee0230f41de2eced7c8ebb88af5a2845a5efc

SHA512
db21f05f73b9da4190144b679edca8832d7aad571e685147feb2385bc0c616e3abbb636168416f1b79d7605f52a5f99226e52df8054a70d3529c01badde73f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
92ae80c65c6d3b8ad405dd567cdd3df0

SHA1
dfeaadf307b6c7a24cc33b6dc2e6410d4eacc1af

SHA256
d7467b391071ebea9c69b2b2eb7fda2a78c781648c5b7f7a18908911f5956d93

SHA512
3c890dede9f06ecae5a1d9c23df904afce1e7842023e8e2d80e26263d94b5f0b7055e3a782895b90133542aefb3ad324c1b71444492b4b6ea1313325bf96082e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1637fb5e1a020d3bee5d033ef0dd6bc9

SHA1
0801e884071651ed5e1a12fe8720a60c2341622a

SHA256
af2b8cbedc61dec935c6b9db245b786dfb028ba892ea984ad1183090cdbfe27b

SHA512
aac3cf9ce8c1c5537247f26275d5d103f0953e4c0a88f8d8b9ede864028079132f443db19bf3c439978b43265f210a98c546e9c5269add2d3c009129e053e06c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
72907e6536a91f20576e548caf12edfb

SHA1
47ac86ca01d7c04032b524ad88ced89ca2b636f2

SHA256
ed24486d18cef5300a9f4971a0190c897971e04b5ef57dc7f048c3793467f350

SHA512
79166bbc4846b826a764d1999ce5b7a802f7152da4a320422702dc15edab18c375843c16a1cfc955d25c1af8e5d88480d52bd5812e600d80440df24598c15db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8347ae9cb7b730e256f4d756f40f6290

SHA1
e9421b28f9d33f44c3d004eef998ed068ee700e6

SHA256
94b8d2d55d1e4cd3e998b6c064b3250c18ca3518f52b18632093087dac47d1a6

SHA512
3ea548b2f75fb08358e3c2449dcbb1744e1ae66710662e911b374fef91345740177287141de7c3af1b39cdda142ef4cc6dceb78e987b92015352d9f6a9b8d524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a8f6679048020777c653d98954ff45e9

SHA1
23639c1cd82ad1a2049aaa30bdbc1dbe680d119a

SHA256
79341172b7a9fc5ac306ddfa71bee03121a96ff861a199fb235d8d83489971eb

SHA512
87829d2208f5efe569d78f37ca5b66358660d81c937d0a9029822c83216d948761c21a8326009de151d708368f6bff8e0fb598dc99ef375ce4846d1a3582e9a9

Download Submit