hxxps://drive[.]google[.]com/file/d/1H2mrV3cwnJ3u6tqITQeAX4zyZWsKsPTu/view?usp=drive_link

Analysis

max time kernel
891s
max time network
892s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1H2mrV3cwnJ3u6tqITQeAX4zyZWsKsPTu/view?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
4272	msedge.exe
4272	msedge.exe
1996	identity_helper.exe
1996	identity_helper.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 4496	4272	msedge.exe	83
PID 4272 wrote to memory of 4496	4272	msedge.exe	83
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2428	4272	msedge.exe	84
PID 4272 wrote to memory of 2332	4272	msedge.exe	85
PID 4272 wrote to memory of 2332	4272	msedge.exe	85
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86
PID 4272 wrote to memory of 2604	4272	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1H2mrV3cwnJ3u6tqITQeAX4zyZWsKsPTu/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bb5446f8,0x7ff8bb544708,0x7ff8bb544718
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16480020650264557461,2889746139803108451,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
38229575962afd4331c2c3b01ddabafd

SHA1
84fc43112f659896005e5027819ef8a024a4dd9e

SHA256
52b62088e14e1c03a8fc89c2b72457247767ae2c8dfb610f3a6a7d06e1836e16

SHA512
5c859366c892d0d4c25f9f81ef8dd250555ba980c68767b03efe19081d8bab02e54b370d306397b203ceecfca7f4505f4c3b87eef3760a625e58486f1388b1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7f61eefda6858d31b8a0003a5804ba5d

SHA1
19483ba1d7df88eaa097f4544f72d849f4e19154

SHA256
85cf54b9191912d6de20b33d5d1c9911dd9551a245c2d1303eb3ef08bdb23572

SHA512
506c9ebb4a2da1adcaf4d8deace0d3a44817e0f9d2df66dabca1e40314e272fdcdbf012d9386b33b31503d181fb86b9198737e7c255586c6be6f0a0aec7cc46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6f62fcb9d03e7891f2a79020579d11ed

SHA1
64639b4e6b056fecfc8e4c568e8a9c509f6962a0

SHA256
e7115c4a3ae9bc1686e75865a211276b2c494e1d062f433f66c1f6a0f85c1cd4

SHA512
f0e05fba7001be28e932930afc6df354fb2313c39ccf72d8f4501abc34dd534b586d68e97cf93b673129f9ba69f8e8d20c2630ddf6ea45eed89d9ae32b429f50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7a297120e45a0155fc500b009d52a60c

SHA1
f1902c48bccfba61bb27ff98ac11cea10acf5e55

SHA256
1ad23de386735a89d66669422bb0c5995607504fd1086d4019beffd12ecebc9e

SHA512
297f3da1dc2152883e823917adc4707cb73ef6f362a7b68ba0cf376db4cd7ed645387ef220b569cb4c1b568145fe20c46b869203bf71819d9e0bf86bd6a799eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1a92d878b25121f8397d41148f8d593e

SHA1
36995d8d65ee20b1a1dce115a0ab8a1414972aa1

SHA256
bcaa25569aa2d6eef4db999289dd576106c416b7549e18ad13425153332a6a73

SHA512
809f6cf7f4afd145759036c246ddc2481203122694cc662916d80c69d1c8952934427d2fe850d75414c0849abbe1eb1fed010a40324a4c60c5b5b04eb169fefe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7abd7ac61a5a6c45697d97d3bd9d752e

SHA1
b4b363f1bca1906b2729283bb2713ef8e0c9ca8d

SHA256
7ec144b84939940440b0ec43ff8067c595d9873ae58f231e54b877d6eb8ff2c2

SHA512
bb5fe81315172f1a6fef4778e0c456e2128a77659615334180295ebf5a7aa8dc0b1a8b1880523c201f882a85d5ca460e95dbc44dc17b9767b8c1137377343d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
043b0febef4c242860dd62d8ec135a9d

SHA1
71209ffda30439c23beef37ee7773de6bd7699ca

SHA256
d1ea9300f130cf8aa450f844bcfe2259a3701f26124de424c5d258bd46c7c573

SHA512
1c202e5375487aeeda0e4bf84cd74a7b8b93c3e6864e5de7be7c2ef74e78b7de96361eabcc5e99cd5eeb743341fe63ca597e6d18e8e2eae245df014f2cd22acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0be5d5f309d3cfaf127c5a419d33dc52

SHA1
89f5d43e53811e06bead5657aa03fa728b602df6

SHA256
9091bf39d9826531ff9625545265e8edfeeed4b3456c584b88b067ce078192ef

SHA512
3c0bb0598e019c088bc11691910650935e97a27f17eab634b2d8c9b813daf974532e56dd772cbb162713c4536a94c8dfaa78f1e431f4e48daa2268e3fe628315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
06d4d3682953516656e85877e7d0e4f3

SHA1
6843236cc304ae64ce9e83468ca8880057a99334

SHA256
8e1376525bd704d635eccb19732afb9f1bf987fa728d7e0b98a247338cc8db20

SHA512
1a6e14446f364ff83235239321432ce8b4679e2ec3918d8b89912701f47fe55d98a4a27e7f3d84ff72af10cefea487c27696700925480fd3130b02f86292430d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6cc12367e2ba4a9108298af0e61dd8f7

SHA1
55958173c971161d417549a1b7f3a066a68cec8c

SHA256
289a1c15d750fa05541d7259a03a73e5c2f13855b733d771c5458468a81c43a5

SHA512
09d3ab2459db8a2ecec2807f08679b752ceea8b01d5e2cd2003e0da10efbbd4e8dd5a88220bcd23a977c4159dc4792cc4e0dd4dcd66cb62bf87d7907cebdd535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e622729f35bbafd1ab43eed61e10b275

SHA1
11eee1b4a43a7d49e5136df3922fec660b1e7dcd

SHA256
37b0b9f8f499b62e24b58680a14b78713db8b481db51b9132a8c8820c5a6900b

SHA512
1e1a718a9252bd36c4626949fc8551d78e82fe40bd933bbe200ef0e46b016a92d2609447eee70accc49ddfa5d19f6fad968a6a438cc864bddc46d98ba6c279cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b3035c5c724e6f85b8c3832a7cc1b31

SHA1
3c7c147ab240f9661089d8fe8598a7999e5a05ae

SHA256
9993d36baccf92e97476ac6fbbf665162bf7a5b8854ac3308e3d2d7fa4b7d04c

SHA512
9e5e96c741e786e15d807f3d5a5ef7634b891e2472bf5d14356c4884942c8c211d20ccc6a7d5559e52759a06e1a18d279c228e33fe194dca4e8e9dcf72dd7ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
863704e6adb1e26309fc453286c5115c

SHA1
982dd7d9d09fda0daef9c68b8eeefccc5eb561fa

SHA256
c58e5d1a739dbc122d1995b3db1bc2d3de8668dd2340b3854d35f2dd1242f4b5

SHA512
1c2485007af44ec3e02716682c3322d630e68832bc845a55878273a678a3207a86ac078ccb2fac57969b5898de759ae57bf55ccee2273c01f4f315b1bcc0f446

Download Submit