hxxps://drive[.]google[.]com/file/d/16YN68frlJXt020spBhRRJ7xD8lcRKlyY/view?usp=sharing_eil&ts=6787fad8

Analysis

max time kernel
886s
max time network
887s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
16-01-2025 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/16YN68frlJXt020spBhRRJ7xD8lcRKlyY/view?usp=sharing_eil&ts=6787fad8

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
17	drive.google.com
18	drive.google.com
20	drive.google.com
3	drive.google.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250116143554.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\592c7443-d05f-488c-b16c-dfa529ab5207.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
1624	msedge.exe
1624	msedge.exe
2692	identity_helper.exe
2692	identity_helper.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 3884	1624	msedge.exe	81
PID 1624 wrote to memory of 3884	1624	msedge.exe	81
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 644	1624	msedge.exe	83
PID 1624 wrote to memory of 3216	1624	msedge.exe	84
PID 1624 wrote to memory of 3216	1624	msedge.exe	84
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85
PID 1624 wrote to memory of 520	1624	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/16YN68frlJXt020spBhRRJ7xD8lcRKlyY/view?usp=sharing_eil&ts=6787fad8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe454a46f8,0x7ffe454a4708,0x7ffe454a4718
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff777f85460,0x7ff777f85470,0x7ff777f85480
    3⤵
    PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8700325371936289202,7337116114751847720,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9d9e89a46ea1c979d600d8ecff95392f

SHA1
a03b20076c4a9bd34d03af90e43d5815943d187b

SHA256
7d5e0d521951eff280f780f5134b8f1b4c614bb4e96ce15577201272a1e4478c

SHA512
7bd673c3e908e62928b35bb2ca183a79e575775a1b76b1bd3e584c9da331d4a4c213b3de25fe209090504ce0af3f3823a27767196ed81cceb7f881106e068429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e66a3d46ce02326d71914c69bb1ff5e

SHA1
91ccf10b11a8c2d127fe825840b0f5a3c5a51513

SHA256
8408d688778cfc5151fd454f1182175674719a8a5709dd36aaac95512c7b1054

SHA512
3fc4c3299a000fd48b25ec9fa88d87892fe60b3e82005195d0afc80e028ff270e1429bb2a4fc07cfcfd5d8c23a44283c92a11f9ff11d28ec951331e3df05326c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
da62d41b322ae89f37893707d64c401d

SHA1
d04c95c27ad84f3e1b2a3b47eb1b5f54364b7f6c

SHA256
2a20bc58cc2b6bc6757e45e8ab328ec557be9a72c1c633f37aa60674e1796193

SHA512
1cdc63e30c69326426b89ce26d07fb0276c396428fed5f25770d3bb4f3e23704ee8c91581ad708f5f02a4454c221b48ea373b9b4422cbf2168eb4917b1e3f45a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
f900827ce0d53c44c8cf7021cdc20c47

SHA1
48a7cf903518cf5ca67f8580fb0e8232a2993760

SHA256
f6adbc0a6f7c197c70f2d5081827fd466587f2eb266901592a0742287b8a8243

SHA512
b3036ff77e82b12a6f2e7796c45ad46c14f4d9dce8680d0d95839ea661f327d278a6f4666392e6f921bd7860e0ab86b67542551447ef76ce3c51d62e01f074bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c43ccde8979ba5896fd0022274aece36

SHA1
00b4916147e9b5e7fc47585b06f9aacfb6cc4c98

SHA256
a0dbb139768cbaa9aa90fb0a9d3202c9bb29be4e0691c355be710d0905549483

SHA512
316420ac11b650a8ce816f4f0036b5599c91ab032f1c551f81fd647a77051d222d6b9202dab25993b16d8fe4dc5d45eb9f671fa3740c7bfa1b94e14b9a54f36f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3c70ffa174706623b53fe9d0b2c6c69e

SHA1
f381f57c9aa8eddf81acda56ef14de3e726228dc

SHA256
3b52cddac1ba067c399a9f5fa0ffd616df4280b250c9fd687c887046f8fb2c58

SHA512
68234365e2b0a4d88fefb149edd291992844ed116e489e82839ce2cec931edcf85e99b2f722e65509cd8bc79b960f34caf0197d6ec29fc6121f5274e4f1746a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
aaeff27e6bbcef69a59111c4b2086500

SHA1
198f83970031f8ebceb65878fcb4b870556a416b

SHA256
e2ea9e3043da9a19615fe1439f32234420406a360caedf15567979d563fa7ae5

SHA512
3883695b0b5c573f924eb7307f869008742d9e673d3b1b89bae1432460ba211a0ec8da6c41033573677e144a174451a142290469fde4f19561e8758e67d0c8a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4064b1d051a7a318d8b12c198c37e3e3

SHA1
59fc64f34e01e32264fcc7f9ab5e06e2f1fc3394

SHA256
41d2035ef85a978c4cebf2cf06ba19c71f4523d0e713df9b6c26fb1bee9c516d

SHA512
066683d3168212959cda1d12c9808f34e38568201e262e71ef1497adaff4afa3683cd467ae91567dbb41a088c22ff928a37471b92f2544f2773e71f95dc4205b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dec201555b819b614199f5984dad8664

SHA1
e7263403aa59816dd16bf783bb37e482cb82a713

SHA256
708e29bbb392395d0163d579b61e94909da4740c495541aa2110add09013e4b3

SHA512
a087ce64fe02680a3e04375c99976ef74a213d4c53e3fbfcf39a25017226721aa9ea2575d5019ed6fd8cd127812fd4f265ad52b5a4aa23bc7cb6663ba001fc65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
73c0c59e31be4300b0560bf993df83ff

SHA1
6526aed2b6cdff18dacd341afe42921a59679c88

SHA256
ffefbfd7208a4a6d34c4f7ffa32dd15f59ab9d8986250a1045ce855b92d2762b

SHA512
7bf9968809e7cd7144060b9a279df9d88568239b3d718e45e27a5b4d73bc9b57b248abc2c19fe47aca8605c4f3637c14778d2ead8eda221052bf57b4ebf10e04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
65fb4d315fb95d0cfb6700463f9b6301

SHA1
19f7e8469ce764cccbc8ad2de6c5e927d9ff4090

SHA256
79fb4248b84cfe445854efde5eff1a9f202ed3d778b1be16f22a9b2df0461b8b

SHA512
b951d05fd64450b485b04c2b58022fd38858cbbbfed0ace1a1306bfa5f3ecb03c7b1514ec84b414899516081c3015c799e6d97357fd13f376e686e013bd0cc04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
495fb0cc5ca29c13d93df6c8dc4b81d0

SHA1
5ce59320761e0a132970835cacb960cec638385d

SHA256
c5d1b40d97309e42e2d573c499433581b65bf047d74346b5c6ede47946fc2652

SHA512
5a124f8086d31faa9e150edabf2db51e742157f0fbf4fbdabe7dd853fd17d3797ac6180e901b24ef22b9ded0a0b70005d38079762aaf3ac76e8b94501179f6c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
51b244dc4eb9b0f76c453ed358882377

SHA1
884be6bf2b788b0534a9001e8159f9aaa149501e

SHA256
9216bb933fa25a1f634c021d9e5a88b252f5b7cd6a5c4df3957fb2a91425273a

SHA512
69671bf83dae12bec9c654d21da431a64c2658afa42194d7c968e00654f7687b72fe03802d082c909d783d618064fdfb89d6901c0c9945046be6471a4c4e0ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c0195f4334b1730231780d0148fe808c

SHA1
0f3f394e58d86c3ab526aba690a3213f01aaa5f1

SHA256
4c3f788ffa8f76fbbd04a388be02e9898e24c6820f852f2e353d585f8ae471af

SHA512
6cf600be2cf1d4b4e55ab6cc8698771b428cf4b1480ae15e6b642b7039cc68480964cd79148a0bb489d0cd55978ed8b031ff0ffd0c2bb8be067e8926dfbe760b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d563e5ddce9814d5b20f8c94b47ded0

SHA1
035b1ca3c2855f2efda16357fe091ff5830b56c0

SHA256
129f67c457d88ba9ac602423c1d819d439faba9192cfcae5cb885780a5981813

SHA512
61f0845c6189101c4db770749499e23586f2d374d178a29c8b9a099a8ef81e840ae84594abfed91ac298012560986e0c9a4001b1bc840492499728d494792126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6fc0ccab118dc0eba89b56866d6c31b5

SHA1
73d7cd7b1d81ebc3e2b84eb90b2d5115116f952f

SHA256
2a2e513eb98a303bf9313c8c1af4d2e5a9747404e7616e17e5bb1274893e1536

SHA512
edee5b6a16deaae176aa4105028a523182a712c22b267a3b04bb62843044972bd4dde1084eafb8335aa8a08667d36285ea5f476eb4b2b83f72849e33d846bf0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca14c248d14e3042e74799a60e43a812

SHA1
5767557a8a7e1f8270e026d12282bcffb05f95b7

SHA256
8add76ce8ef539508ca50872ac06a3af407ccc9b2812556972c0462833cfc057

SHA512
0e58796b82e6ea577423724d02f84af5c951a76d9ab55cd5ca855a64ced6e49f59767a8017b206672d000af7b1dfb976d15c0840f6c172377d9f5f4298fc193f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
924cb938e42e4f194479f60326424d0c

SHA1
ed9ba612f741485dbd5fb464a76b4916e9d078de

SHA256
c2dedb0dc5bba4ee41d4d1e8967f00c5457678eee41c572d2202ef6f3748482d

SHA512
c65d4b98e354693cf55a3ac8de67c97233096b28f0bb17f029f19c2598b9a3947646ff5006f44aca76ee1b9608c18ffdc887607878698e94473719a2c9852891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ff5dd20177add5f2fb07a017c096ccce

SHA1
7afe60457ca44419c3421847c4202a50fd4b80a8

SHA256
0e18c1f1f59aefdb789413aefaeaa005421e9369195f7c35929008ec30b50cb0

SHA512
3bbbb7e4af49e8a92b5dba457567a249db23b50a1b4a79c33bc38a14e5dc4ae9dbf480b6f42abfd3da28af57c06aeaf4b0b7f3da39b712ca49981c8c7973c77a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8bbb70b63ea38955801783c83b928cf0

SHA1
91e76aa432aa9b323f7f8efb7dc94fe0b9587496

SHA256
e31be9b1110c9d3f71b40293c8f3d21fbdb1d53910d91dad2ed1f29c363102cb

SHA512
1172db8453c8902fe6ab8e417ae44da691b72e8e05a50c85d5bda1ae3cd6b54407b1393d9707cd152bc37ad56b1c380ef23dae445f8f27e35844f6233132804c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d3375fcb4ba40aa1470547271bc4c3bf

SHA1
aadd1b96b059b1e647a030703125d40c5cc2446c

SHA256
8c7cb2e2d39fedc84ebae18d1bd755128b793ecc4c3dd4fae33b4afda80601d3

SHA512
870ec8cad323b1204be40a8ef47d25f9103ac68d9fe4277092b8d271618066de3118e192561aead53e7254b95a88efd3fb74fe587afa4ef31d413af3dcfd0d54

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
04d21d5498577b6788fee4df6bb3f7f6

SHA1
69556a846931bd2a76a7f5fdcbc2d7612e6aa997

SHA256
bca3daaa91207f77d0731621ddf98a4bbf81fc390c7901fe2982c35544de8e89

SHA512
dc7ce39fbda24449368a96b340e36919520411013eaa30765aa9b575ebc49c4989e0c0a9b3262e1138d898613ce1d33ba3ac35e9a32b80838013d4c7a472d2fa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
84289f81a05e594e8ea30e0107973e8b

SHA1
dee93b4afb20a74e943a09e71f8403077a042e69

SHA256
a6f5aef132848f4c593f8028eb109471739cb7d87bb372f4e420ae9322677adf

SHA512
eb80f86501ea865ba1b889d5ba267e81f02bb9bb66d3ebdc06e18d7de8730b5ffaa05602756630f58a7bef74a08e643165160b7dc24dc5a9953f5e77a7f71330

Download Submit