hxxps://drive[.]google[.]com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?usp=sharing

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
3620	msedge.exe
3620	msedge.exe
2716	identity_helper.exe
2716	identity_helper.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe
5132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 2884	3620	msedge.exe	84
PID 3620 wrote to memory of 2884	3620	msedge.exe	84
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 1276	3620	msedge.exe	85
PID 3620 wrote to memory of 2004	3620	msedge.exe	86
PID 3620 wrote to memory of 2004	3620	msedge.exe	86
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87
PID 3620 wrote to memory of 2236	3620	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa515b46f8,0x7ffa515b4708,0x7ffa515b4718
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10176845107247855063,9239026607480007347,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
39b170ce3a3c7da0959e61fd58bfe26d

SHA1
c5c382366e4f71ba28b276e6b6d70fc9826af6df

SHA256
bcf652453f1f30a80dde7a65ac29b6c2b6e664c26f1221777d33898982518af6

SHA512
3d2339d25ffd73d4b8a9beae1a5653db74c059a27c572b9188d0d2bc8c312e9819aee56c28991b922504f0b58f6f532e75aa3099b80582bdeea00ccd106875f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
3a82fd86394dd20d2cc3c0b5b29b6134

SHA1
be02678df77d3c14c412675ba69cd213e8f89cdb

SHA256
78b821d0643e463521b0ee74a4e636437f885029f31bd70387e874d2c5a8a687

SHA512
a031ec145c0a584f14983ba041882caad6814b31b290ab2abae8b1090b079c3d0c6276fc7de4c9acaa5c69e604e5611f0ca395f8edbcb9ac4cd3b7947004a806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
11488b1e7aaad5967689aa63fc01f107

SHA1
149c324a5dc6b62889f0531ea0d4068aa56f0a8b

SHA256
94449a73ac96c69b05a18dcf66cef4e983303aad96e6f55ad5bb63f8e57884a1

SHA512
249893c589cc96e3d22ea7e2df77e1f76523ddab7e5b5e14c07824fa7898b3e5d367f0132aea34915330059a40b84da81b982fdc6f88f4bde7aea3e57ca370d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
21623d8933b9c6709769d030f23d2d8a

SHA1
3a07d6822551912b1290478d4eeed74166927cf5

SHA256
eee16341274e9d641bc0bf47dd9c63c2048aefc08547f04490b5f8d9c0b51224

SHA512
08a9769d9d54a9115e0b13b84b5216d9800dd01cb48e6842f88b98d75e8a61ecf9de78f900e02cd8f806e19ed2ad29551b83f5b78516a7ff6005f70d4d640910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a9caa92507c6e577ed20eca2c7268d8d

SHA1
e0207281fb8c613c14c4fa8c977ad18f469278ba

SHA256
38fe1eb7473cfbb6314f785e588def748f69ed9f588a808291e31bb1b53cad76

SHA512
a4eb4e542421395ce77384ec5a828e3d623a16f882a70ccf5984e8b00b6f48bc304b8bdf9df42bbaba2c77000da30482a58470ba4ecbda3474251488fe5fd17e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7f132d02eda8ade1e86f27dc9c7dcb1b

SHA1
726169ce97f447227f3643cd7a7a023f4af69d5a

SHA256
4f7661265185cbc994e367e567e7b5a2aed2bcabed94adf96627d0e2a908eaab

SHA512
fdb1e4f9e2c01a4053915801dd88ec3ef5536accf30cf9f7263d230540473067a17267f2cb0aedae308cac25b19c874bbb89cf427bb133dcdfa3261a5de5b375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d48666d2fbed6dbb0b0f0d4edb3fb62

SHA1
9033bfb6ef6f623fe2b63a6ec40b91edae1d1fe9

SHA256
de7f68a86a85c2494ffd82f21e888e7e7568388a7530afa4b4b118b75811e9b6

SHA512
2ae9999233dca4c9c909c280bfb37fc99c9aa4c8f77a149462960e4d70f696ed1b26d448fc44411aaaf548403075e569bd0d74aedcaf0d24b5e9ab72c8ea4bad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
64119b28ff443a8c8221a3bd746f9763

SHA1
ad6cb70b8d9e1c32461724673fa3cbe4f98e96af

SHA256
f3e594e4436c4091bf740faa00cc66445c4a68767c28184e6810afcf3a4594cd

SHA512
734dc1fe1f9a9d42a9b19014d82f313002aa1df199b69aa55fa9fb71a47576f28ad5281f39be8f47d6243acb2e241adf580715cf971042fef6c00e85c1bb8407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
09efa54468a06e15f8f9e52db27f1823

SHA1
b1c2e560c3f61635cd36c3de5b3ce7e12a8902e0

SHA256
36d490433b75991919f43f7e44433a1190cbcb747e78d6bf6a4e34dab25c347f

SHA512
50e18076d146d7b97ec6669a0bbcf5d4df4acbe671a84164dae98d11fa9245f63cd0117e69740aefad4f48f5529f0f24ce3d6f31ab91476c5e41386467abbb8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584aef.TMP

Filesize
1KB

MD5
180ae719654ee4cf80ab0b1b9d780e81

SHA1
2f84b816c089368f9e8cdc03524d967e11b1623f

SHA256
e22e3e2ba32aa8168f18fbb35b7f9326a37b0be7e990cf42df2c92ad96c64ab2

SHA512
3b525576da77bbb4d1a759438aeeaf8877fd19a1bf4ff75258a9f033c75d242aa5df97e28c89143fe85603b8b280934e02e4bb7e2dabb24efa46543d2e6abee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
23f361a7422a37f024799dd5ce00be34

SHA1
1b764fbe0c49ee83bc23a19be01a9353ed5bb2ee

SHA256
ed474a22c03845759330f60f31aa6f8a355ead858c5bfb3ea1d121f0cded9fad

SHA512
19a8e4c8818a56ed1edb8dc531379a617220be671143db9bdd22ebc44ff7079cbfcd7331cbf5cdd69977caec62a4ac1b5e2b205b1b6e988197e5048a5df3d170

Download Submit