hxxps://drive[.]google[.]com/file/d/1PT8mxcO1au4yNNT4vD6-hWIm-OYlexOi/view?usp=sharing

Analysis

max time kernel
124s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1PT8mxcO1au4yNNT4vD6-hWIm-OYlexOi/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RJ397236.part1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe
224	msedge.exe
224	msedge.exe
1704	identity_helper.exe
1704	identity_helper.exe
5892	msedge.exe
5892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1780	7zG.exe
Token: 35	1780	7zG.exe
Token: SeSecurityPrivilege	1780	7zG.exe
Token: SeSecurityPrivilege	1780	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5400	RJ397236.part1.exe
5400	RJ397236.part1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2228	224	msedge.exe	85
PID 224 wrote to memory of 2228	224	msedge.exe	85
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4596	224	msedge.exe	86
PID 224 wrote to memory of 4116	224	msedge.exe	87
PID 224 wrote to memory of 4116	224	msedge.exe	87
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88
PID 224 wrote to memory of 4336	224	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1PT8mxcO1au4yNNT4vD6-hWIm-OYlexOi/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd4b146f8,0x7ffbd4b14708,0x7ffbd4b14718
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,11610264255650710977,13747807253216661631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6040

C:\Users\Admin\AppData\Local\Temp\Temp1_RJ397236.part1.zip\RJ397236.part1.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_RJ397236.part1.zip\RJ397236.part1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5400

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap32585:90:7zEvent8389
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
ba86cf2272757cd180e84db92b0cad26

SHA1
a509a35a7ae0a55083e1cf3df228f6c089361d26

SHA256
bb09a72e058d9006414aacf3f231076945da8696ad907cadd4ab24bec9c93195

SHA512
0601de1f8cb069689c3a1ab200413f7e3b3b487493feabba367926a62484193d292d6a7fc1a23de93ebedc419f0951b8e6e01a19435f6b8019d3e843bdd9531e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
50845502d8d255c94fe7785e747450b7

SHA1
c1d0e3d0370fcf0013324cfb88f4013a3f935c8d

SHA256
f7cfa9f069f665701923fa350a3a07b93b128541ee8ab68849d14fd8b6e30e19

SHA512
5fec2819405682764dec958b5aa3cfbd77b939ce59de9119409f8c3d55c4ecb297cdea9a4f8e2e08af66f8dba4a9594e5781bc517dfd16dd6916bb6e538c6d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b73dc256123103aa9cc492905337f37b

SHA1
10e20f59ab314637a053fa0aff7b791c17c3811c

SHA256
a406f45a89317a7e029b5fdbb1a75556b3baa6a10b9456af3c9c3305eccd362f

SHA512
b52490e86902ce7db34d95e2276fc978b8739d11184fc43bd422dbf287641904e5ce61596ade92dbb01b357116efcf0c2f8d1bc8f82d6b639e8a1715bf2fc7eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1c19a8cf8c77192964f8a9f675ec133c

SHA1
bed60e36a82fdc76c29d0924e3932d27afc42f58

SHA256
1f7287b816bee141575d5905dc3c786216e234eb60505e158493f618132e33a0

SHA512
50947b0653857b01d90d4d8288cebd189cdc3a4190774934eb6b26152310dfd2019f935f06a9e162bd340342f76dfb36b8aab0fdfd98ddcfce9065210cebfe74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5eea3d137465151db9b8645034e5cf1f

SHA1
6c790a2840052d6eed23e6faffd785707f33cb6c

SHA256
1861ceaeae089290f18fcdbb332a95b2506558c393a324853a950b3d9e0b94ed

SHA512
efa5683b780bc1f7ab0d9ac5094081c6537eaf839133e63e53645660bc210f3cc29d9d3151976d9f428fee5231d631bafeb780c641a093c50d575e333c7f7e4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44105f8e5763c2670e2fc345df705c9e

SHA1
422762fd11f4f03a2267da7bf01a3240020c672c

SHA256
d035da2deb065ac0514cc9a4ce2226d3f41453bda7ac348f55e61a1906765661

SHA512
1ea2c58e26043dbc75925192a5c74a9d8dfa37684a67ca3cbec063c5762b97c39e5fcfa2ed9000d5b80dc86de5a0c334a57153e8fec339e99378a05c6b27959f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4007c740c1f01bc9e3a72e182c75a6e9

SHA1
9e7de2c3056fec46c05b8a69e97b41e00628c2aa

SHA256
3f8eb1bfea71f48635f7869cefe657e8c2918ef50c5d2e0afbc20b847bb9f0b4

SHA512
ba66458daf2ccac48071f5b123fbffad1c37bffbfb825df8a73e9b228b056fcefdebefebc14210a03f0b51876bb9e67a89812b9316496a74afac411b61cfe343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8303343dbbeb6960b7581b7b38178ec7

SHA1
2b4512a4b2c6068199b5db9ae40fde2dbdcdac54

SHA256
7cf5851d2cb033dc0030fdc376bb7afa157cd2bfb778aa64238258feb657ef1a

SHA512
ffc4f12c2bffdcea3c0643dd9c6e9033adc2abaf0c317a9cbddb511468952a2b84a2dda76ba8864eaf2ae21466f8352544361e583aedbf70dacac250d392108f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
12fa476b356a308177933fd9d3f0ef48

SHA1
200bc269f57488731aed6a8b95c15f9c68b5f57b

SHA256
61e9abf6102ac42d84a4a629dbe8d96758f7944cdb9d8e0827f4083c7fc1b5f4

SHA512
f6ebdacd5e512c65d61c9c6e2591d08ecfc2ba95f44052736a3bf466660936f2ba45b5331c8dac0aff117dc1f855e83f52b68930f384799ce176ca6d11b2f26e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1639c8f08c50acf5d3b7f938eae66fa

SHA1
07cab28230477e0dc56b9839fb9d7af3a186cdf2

SHA256
5e0cb843f00a0d31158f4660f3d6de42ad9ae1e5f8296a0ae8e667c61e1444a9

SHA512
59d60cadc9b1e592c8b8fb4062752bf0b17887898509758ff56ec607f432e21310506af5eef1181334a38978c24d626f769d13a767062f23de33675cdb4be6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eca02e80b3235e2d683b1d4f9eab6c86

SHA1
8190859078ce407ec1bf721c9dd6c0a1cfa377fc

SHA256
9dc8fcb18787da374acda860416427ea25f7bcc8829fa75e35162219ae922213

SHA512
e5ba072346dacd8abe33ea83855457caee477cb8a8b6e5a9b0d1515863c50355082eb5bdeec2403286d7dc9a24d21c35e3ee417bca57ff0b4c4f49d0a021242b

Download Submit