hxxps://drive[.]google[.]com/file/d/14gNt6P4SsLPG_FuGZEDYUQYE6b3Svu-N/view

Analysis

max time kernel
900s
max time network
903s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2025 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/14gNt6P4SsLPG_FuGZEDYUQYE6b3Svu-N/view

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
143	3748	Process not Found
165	3748	Process not Found
160	1468	Process not Found

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
18	drive.google.com
2	drive.google.com
16	drive.google.com
17	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4824	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
4220	msedge.exe
4220	msedge.exe
3904	identity_helper.exe
3904	identity_helper.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe
4364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 1040	4220	msedge.exe	86
PID 4220 wrote to memory of 1040	4220	msedge.exe	86
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 2108	4220	msedge.exe	87
PID 4220 wrote to memory of 3112	4220	msedge.exe	88
PID 4220 wrote to memory of 3112	4220	msedge.exe	88
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89
PID 4220 wrote to memory of 1324	4220	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/14gNt6P4SsLPG_FuGZEDYUQYE6b3Svu-N/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd034f46f8,0x7ffd034f4708,0x7ffd034f4718
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,655353868501056969,13174320703197904962,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NkRCNjVEN0QtRTQ5Qy00MTZGLThBMUYtMjlDN0Q3MjE2RjRDfSIgdXNlcmlkPSJ7RDIxRTBCM0MtM0ZDRS00QUY4LUE5MzAtN0IwNDQwM0IzMTVFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NkNDMTUyMDUtRjUzMS00OTNDLTg0RUQtNzU5ODg1RjdCQkQ4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDQ5MjgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxNzQzMjM4OTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjMzOTM3NDY2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ead70a280cd4aec1e24cfe04df29829

SHA1
ef230ea7095f9b22df171356ea4ffdb68b1f8b43

SHA256
d766ab618981d2070b1265b32f402563c88ca5e68bdd2e5e164323f5520af020

SHA512
4ae4894a40d4608cd9e62262c575e07b2cfe48a3d0a984580e8c9ce5e2085719f6c167dc0e5edbc087b7ccfc894ccfa8dc3a847da8faa7007a4cd252be32be85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9bafb0d3a1696932066ae7d4a377d44e

SHA1
b806888e572d4ffb5d03b0cefb13ab1542b3be17

SHA256
9102ad8bdd9057acdf96f81aee73f00296194718730f2cb6b95cfbea9447ea66

SHA512
dd3bea301dd70c6ddf4bb43d51f39cb2da48359f24e449db21c97b73a818885a68a3f7aa7a9568443b819746d78986d25f6e1da4d4832f11fee63842d5f5c0ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
785a9a2336e708f1112d2b96598f4c02

SHA1
d4bd8363e4dc5821ce4b50e1389659ee89e36c70

SHA256
c5dac22c2fbb66cbb6685921db831bdd2c75121b16b3a77c1a3972f31dcc4397

SHA512
ac0f4fbb6ddbf4590bfa4769f24bd4551db258c205ef6d2b29d961978d35d51209febeb3262b9d9be034734e409392dc551718df435556ada378a0d1fced5e1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
bdb3ed3bf335c95b53f946529a8d9542

SHA1
c7eddc8b127642541112dda9c0904e5b4079e87e

SHA256
c083eec4cef2ce26b8091b2b088824ce947587a884aa6099e59172b80949760c

SHA512
db5b66dbcab375dc632934058a7054529705f09a9aa7087bcca06c48581b8590073513e2317b8da5c8220d2e7b5c3727f68e01c84a74f00b5c30177a6ae9c392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
31afffc38298e41489887ff79a050b5e

SHA1
bb64591f2b345e649f0fe9be92dc72ae82eecc51

SHA256
3cbb768f2345b74d0db0bed2d0e71cb6e16484b4ab8c8cec59386933b4212df3

SHA512
8563d5d148e28290169bdf8db5eb45759e22228101d63d648b68f119143391c689ec5feb89b73d7867fcec0a54f07a9fc4b993a23fb7244a907255de6fe879ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8810b2935f53904d801af4d8f0b76b1d

SHA1
e6742cc2f0e2d21403956b4f241c53a110259df6

SHA256
12d022ecc0caacaba74dac76eb960e333d0d9c3943ae580412c6361e589e5bbe

SHA512
9d82c1fa51bcd1ad38c509a3acfff9c4ecf7abd12742eb3e207cb8d73e8ff0834f8cd9fed682ca68f95a69b7593cb384768919c52f7326d9bf6a43977e903e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
af0d9fe422e26d6e31e00446f79870a2

SHA1
ba194c4f72b3a039ce8f4c4f5d0ca5363ee4fbf4

SHA256
f805bb58508e69f03d32b5cf354d7243a452828b53d87c5354ff8e610db8b9d1

SHA512
b4e0dcd4e7c620e3f2f3f909b628de332aa6f8f212c6aed8d55fe3cf86835a60fab37a4b9a4e383eeee3a76a2e607846573df5a86e98904961c1dc4c7962d5d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
602ced41a45fc030b5af328de40d7911

SHA1
60cc58884f9eced2c38008021394e8ad82bdab78

SHA256
acb5776e620bc054d2be0b5ba7af6c60004b2779a2b634148870c7b6a2283cae

SHA512
1727ef996a0adb2068740cbc88e0af97cd68745e19cfbcc53d3ee491f96efa8f8082c0af9a98658beb9aaff0138d2676b6200742fe08ba81b79927da4231ffec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b294acc1db7edf4a96192b94188911f7

SHA1
b0e7bfa7cdbd36e3bb0b740ffac9e9e15f4608e9

SHA256
dc3fb84b85ae0616e1708309c21e9f041504b12d4558f0c9658af04c5be097c6

SHA512
a6788b1b36567ee7456a040e2b73820a9b9ff70c0be36f786773f6b76a24c23c9836a9f7cd0ac1b0ce42f98bfdd9d09f132fddd10507938162425e21fb58f6b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cc264cd292d7f98a5d0169f8ed32c083

SHA1
ea4429ff10e2126ae338348da9c0539533a75b59

SHA256
db345579d77d7af2a5ad7a79623893ad2a8b44c8143a05659155a489765a3175

SHA512
714c64cf7725a67b6921949ed897d2a61e7448ce069a27588cbfa8368fedbc0eb02cd5328f2c40c513c1cae37814c876d0ed21dd8f99879609e15a12d401e586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4e5368dce7f67fd813453dce1828a600

SHA1
b4f03ac26db98c3d316728853933da7fa5e1c339

SHA256
d4efd6ae5d6df761f26d6800150a2c1567433e688025096068597372914259c2

SHA512
ad8354761c090d9081a09504db9b2d01a3430cdcf95db3480560c8a92723f826bc9301daa9c7b5eae0c0ab53569815cf69d7a02fafdd17768c39bed662ea225b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dd1d6b6eaaaa39ec154d51617b958a31

SHA1
ace92f85a1ff7a04c1f30ff25a3d3fe1ad69198f

SHA256
7cf6ccd95efd3d347fd6472a0f93047f893024dd9df7073757afdbdf45cbc827

SHA512
9974884349b08385b3d563bead81d3de7f0b2b1c824bb566eb6060c37bca5872092f27fc61b55bcb9ce937b8a4699cec7e4de981386e6917fee537084d89ce00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0265343d9c0f7024cc141e6a3ec0267

SHA1
cb5b88745ffd1e2c32d0a68ef5678b671f6dcb28

SHA256
87f6b04d8a4c502db20b2e2a664cc1f4ae9c6c34c8e87659e3ca05cd55f95e6f

SHA512
54c355398ff3b0e1a070e10ccb58d33397468bff5d82c9f0a1f3087e64906a07ede8885aef5663791240d6fbc28aa01e0b9a862d2ccbad64195faa1789b8eb84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c034c43397129ab1ceb510856232476

SHA1
0cc3ee73bf1555efc70b79e73860e45f15a4dac0

SHA256
fd6e1dbaf8159518154fc483323380207b147a2ffee7b36424d479902313ddaf

SHA512
602a1fafcd6d09bc0918dee8176ac7c934bbf2b542e89f5ea7c1fb4fba82397c729aea5955427b1ae85e1a208e5ac857bb6ea3ec8496f339b021ecde90536a8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7dbb974f53351a574a9502d9d8426663

SHA1
9c50a72c03161faae7f7057680ec1ccbe86ee221

SHA256
f7406c8f6b618a9a78d472a626888f8ebd4e6e28cd050943dd9a8e8787aae8a0

SHA512
0513f1f75b4c4c9485363db06ac9ca5c4d32a02d59f62f16467e4d3c68772a571253668b3ce1f4e6855fecc47ccaa0a586a9b0b8e2775fb8570376b68ff4e4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
39c73157a82864b6bfdeca7d8ee570b3

SHA1
bd97d776a5f0f6b32447380a3816d5860e09b908

SHA256
648c0439a2f9ef116db7ba2747797e7a762a5f83e6472461611e0469178fde47

SHA512
2ed981baca0494f7c0a621fcdc64fa81c0af68ad789ae1b9fad8fd2c21fecc1df5a4d1786b81b1c2175aa3d896215862e920e1935bceaae4abd3567e6fe7b2a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58079c.TMP

Filesize
1KB

MD5
8d3381b1e0f277c4f46c908d6b29443c

SHA1
58eb41d7ec1d7118d008d55a3aea50f87592177e

SHA256
306af1e2195c6140beb98f0aeaf8f862728ee7ce69ae4f4306a519f6a104132d

SHA512
df1618772a1deb7619e7be2ab99fe8783bb6f8d5b5dfaae706f051585191cb616eb98c8ee9e80039aa37b8eda912c9550bb5faa55e8851b8fbc53b70d8175426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
25a6a5cf9d2ccb41cd36e5b20985835a

SHA1
59778daee61c5518c051429055a7a5f5975265c3

SHA256
60d115286924c581c1c5ace284be8a4acf8188835b7ee6217adc21519bd6129c

SHA512
4639af2bde1619dd2c82aabc167917bec0ddb99c5b7ac6de04211551aad9c471a960e311c6c1c1ded5651384e12b3184704ff63dac9c1bef8f79de52bce85310

Download Submit