hxxps://drive[.]google[.]com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view?usp=sharing

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2024 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-857544305-989156968-2929034274-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
2920	msedge.exe
2920	msedge.exe
4380	identity_helper.exe
4380	identity_helper.exe
5008	msedge.exe
5008	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1412	7zG.exe
Token: 35	1412	7zG.exe
Token: SeSecurityPrivilege	1412	7zG.exe
Token: SeSecurityPrivilege	1412	7zG.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
1412	7zG.exe
1412	7zG.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1744	2920	msedge.exe	82
PID 2920 wrote to memory of 1744	2920	msedge.exe	82
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 2460	2920	msedge.exe	83
PID 2920 wrote to memory of 716	2920	msedge.exe	84
PID 2920 wrote to memory of 716	2920	msedge.exe	84
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85
PID 2920 wrote to memory of 2408	2920	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1d-AcYI1SvRj8B-iwa3CP7iaGyuSrBE28/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0a5246f8,0x7ffd0a524708,0x7ffd0a524718
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8229289621695722573,13025292124309931072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:1
  2⤵
  PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1596

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap30248:76:7zEvent2988
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8d8ccfa6a8b1b15db876b848b8fdc102

SHA1
dc7d92c35e9c84d8d78ac0aedc926214cee68135

SHA256
b48f98046030e23b843422251481c3f19cfa0cf71fb36a8ff89dfcb152761f86

SHA512
6ae61b6cf236082b9930686ad2650c3ce3fa337550363e0858062dbb399093b0ac6bbca3d4c40101e222ce764fa4fb704bfc591e6d5b0a6c165f170cd6c9d5b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e22c2898ac78c14a840076a8446b9d

SHA1
ff5b7cca3ff2c4e77e6330e2c5e2b62bb56e9fe6

SHA256
a5e570fc8d3a52027db48adf1301fe8dffc500a4bef04d0d6bff15fff78ade8d

SHA512
19381615be8f53ccae56a21c29c314c3247ac78fd3cf838f52ca98757b54f945f0d178cfb44ea5ad42fc68b3d3e6e7ce4e4f40eb69f791fa5132f591c62388e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
8eb029c99d8ab57aa08f034ffdfb2813

SHA1
79f0ef795d84573f741e21e7586347b54a1a6bd7

SHA256
23aeb6eacfa2264fb8e3c24ba7d504d641f628f68d3cb2da8a97f97d0d9e18af

SHA512
876f369f9efc7a72b060e03c1b7d2b9d6c7c191b59ee8fb4f49f9d80a4fb876aa88f1af561dae5382cdd6a9f503ee975a8855e34fbb823480dccd40793f8b112

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
97ea7bbb348a6048907b1112568edbfe

SHA1
ead8d97fcb00c962a103d7e7d465f1eaf1453afd

SHA256
c57ee08f4e3f12760a005350cfb2fc54ec27d55207425c0f8e9e8f1ec9b44103

SHA512
d7dd84ba0a3fca65af68b5f47dc70c6cb5acbb8568d9dc6599838decd94457c74c3056245cb4e4c78cff08ca67f90ff39bb86c5a7fc393dec87593cb7474ee0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e95311205b3a1fbd4244305a907c8fc6

SHA1
5d6fdbbb703a0734f4221303b3bae317e9ef920e

SHA256
aded36f8005f4aa42b3d8847ef463bd11f59dfbd6eaff7edfec7199a31a61648

SHA512
f41843dd9c0dfd4e0ac13de687dd82ef81e3e8bd9e98748012be45eaab524023d60167fd76679cd32363fed7f9a7e6bdc07007abf095c4db8f14e96e9f25e247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a257c0cfa98157410d1353505a06a7f

SHA1
a5cf9d3d9110cef86c891d721d1737d67b3db3cc

SHA256
f52acaabe0b0fc1d63542a589a9fa47fc76dda58f160d3547c1140cc5828627a

SHA512
209ac21676396fae72885c881d03a41bc2527bfbb49070fb8483f9b257ecdf97d86db3d099f8b3c877f7f6580df3e8bf6663aac2520cbbb34a77e02b6ea45a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
42d734853758daeb16bdd135a54ddacd

SHA1
5f4defe228f1e777d89ba4381e4df0be1d66c5e5

SHA256
16e5b6b6024b26730ff2c0206479244f1ccb72fb86b33fab925235908abf7800

SHA512
87bcd15e110a8e7b9c5200a731a612934084fd6441faf7094da1a32e32530723940e9cde5b4b6dd054d071ef886c60fb8d30771246aeb0a902a4356ad73caaab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
367cf7e595ca98479ea677f1259f056d

SHA1
e8001a4825754201a321b2650bc2ec0be3f5d3e3

SHA256
97df326cd4938d04dd7aab27c239b0ddd5a9cf6de79a341c9f484f8f181cceb2

SHA512
ee85efb1c134b1681733f8df8e27e8d15c5eca162b23055a3bcbc6fab4efac3e61a4437b6e9492eff9175ac7ed7d890de8217e5ed5bea6af3f5e24af30998d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9a7abf27c8a8243f8ef60eaa3d96f32d

SHA1
d9ecdfc53b67c280faee35fbc02b4ac7266ab244

SHA256
faa1491c5f1b9254a3510983cae2d7b079a7cd20b973481fec43ec3e861d0de6

SHA512
61d3888410b8a0856867215374e0b29a331a1f9322e4b44d6d5a2c81dc4a7947241a302cd68f5b352b7f30a9f8b1c636c90eaf7ea4bf8d16a18cf3bd9dac6209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0de78ce9b199d4a5d98f23cc7ade7719

SHA1
be6d005e8b0ceed1d3f4946121083b66885a27cc

SHA256
4335654b1770edd930de6ed51923e31c01104a46bacce90e3200406994b6524d

SHA512
564f83e0554d573488862dc69f536ab9a59fec8135c752712b9c1c4631a1c228016e991a472a487151b6b27acbd0c53bbdca747acaab510f4d1929bdda0670fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5856efa17bda137b98cb13ef0b4b7411

SHA1
328ec232d20feb3ab1e1221a33f23a60b466926a

SHA256
57a9854b627d2f3fae967a10e446ad65f7c45642cedbb0b4c39c7812f4c1facc

SHA512
cfd6a5866ead9b3b200ab93d46e7b21da865c5a02da162710cf05e54323ee964ac8836e314408dcd6dcbd2760ba14e22c573a774a11e977eeb56329b3110886d

Download Submit
C:\Users\Admin\Downloads\Downloads.zip

Filesize
27.3MB

MD5
0c4a484570940bd4ccd59b89b42f2744

SHA1
c3c05c5b60a5923a087ea28e9ddb6d3091083c6c

SHA256
ecf6bd50affd1daf6fbe5334b8ab5adcf27503ea26d73a5031803a33b8ffe6be

SHA512
a45202cabec55adb024d30d8f657f87412d9499fc1837ec8985522f434e4e9c5daa1566b42db26d778c443b2c4be416855fc44aa72ccfcf6e2d97c50c08f71f6

Download Submit