hxxps://drive[.]google[.]com/file/d/1nyA3VVfGf65kiCFIkZDSIdU0mXteEHO7/view?usp=sharing

Analysis

max time kernel
587s
max time network
524s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2024 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1nyA3VVfGf65kiCFIkZDSIdU0mXteEHO7/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
4236	msedge.exe
4236	msedge.exe
5004	identity_helper.exe
5004	identity_helper.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3264	4236	msedge.exe	83
PID 4236 wrote to memory of 3264	4236	msedge.exe	83
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1204	4236	msedge.exe	84
PID 4236 wrote to memory of 1336	4236	msedge.exe	85
PID 4236 wrote to memory of 1336	4236	msedge.exe	85
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86
PID 4236 wrote to memory of 1080	4236	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1nyA3VVfGf65kiCFIkZDSIdU0mXteEHO7/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b7ca46f8,0x7ff8b7ca4708,0x7ff8b7ca4718
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1304321807858839960,16102182325172598083,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
1f0c51800192397321b8c8ed85b1c28e

SHA1
8e6f65e217ba8e810c41c49fe6b6d68919ce5729

SHA256
a63dfea87294e4d34f0f35119af2a00c3f8c58603bc490bb4ec4db06abf60028

SHA512
1338bce42c61c557bee7dd16eaccc8e4286561b023b1b1936b03ae56d9bbcbce47c71c0204b4d207df5ecc1094c0a46b02038447e1f3c10f53d3e9ae3252e9de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
618a966c99e6d442bc237434a64f8ae9

SHA1
e70ae49b4ffc347c15d71d4ad21912b5311aecbe

SHA256
43b131e0ce8bb8b7eb84f1703826b42053350395e77304fe1cc162a89b05152c

SHA512
8ca1d5f01f263466dedad25fa08f2a1e3a16419e74813cabaa33cef86ffcb939161418e99778516802bf99fdd3532ed37e4fda87fd53586f4190dbb96e60f2f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
473b91cc6304eea0db5051141b91f1cd

SHA1
9c4c2b23546c0bc2fcedbb62e46a8bdd53738c49

SHA256
ebfe5ad378ba1aa15ce6a9257ecd603ad48ae64ce13aa3096a84eaa8b4b92f3e

SHA512
6994b32a6fc691deeb001fd20ff226f71570abaf153a69e4707044d129510c32b2d7117cbc512e670db51883c8bf35a223ad7db9eea21f233e7508a29f890727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d3931b064101cb7a4744b56165077b21

SHA1
228da85188cf0a39e109dc862dfc5ec63f9ecf39

SHA256
337f8c4b308ed067f130d9630c8b7d5fa17eebf1ac3569094d05ac40768eada3

SHA512
633c48bb076312f8a52496d27be3f54760aeb332586236d9053376dcc8418bf25f979b218337635c144bc038fa2a4c27e2a059c47a639e3b88ff89e09af9565c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
40ef073215fbe1f82041004e15404b0e

SHA1
521b52e854314101d69dda0b16463bd4b51cae4c

SHA256
d6cf660613677d3676a0c712fac422e10d3a6baced347a0776c953619d89305c

SHA512
d5595dfc2ec81213e3a7b871a42653fc5ffb11176e4c801860eb2b942b3c5a013d84b69ed4ac47fb6d8b7191bc7e2d140714df756b71e5a8a2ab94caa6cd4477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c830165746270e400bc64fba5d8fc3e8

SHA1
ecec3a62a462def604882085560e534d8f4f80db

SHA256
44108361d5fa18f739dffd7f7bebc0e88463b377a89c8e7db0f91909a981dbe5

SHA512
e33ae394ba1aef05e34b8882e0767ba2f8f622ba8ad4f69baa163465b160f2a81f9d8e19193da3d654d2d15468e2d6fd38a1812811ca3fee640287827c5318d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdc8bf625de1c172aec5c18c7ee89c82

SHA1
6abda12855ee9ab9880318d8413253140255389f

SHA256
4a8e34a59132610ac71700a2bd3851f75bacecfa36e1b579f30ed49f30f353c3

SHA512
89e3c7776cab3c2d9c60df1341b1411a20dbfe2007aececb246466546442a2e99a9fab735e583d90b320b1c5c99e58824a6a2f80671e597b07d8fe286652624c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67fd5d2553404bf0e07ebb4b59fb29fb

SHA1
c734d3bf052d673584a6c81b081acf51da377d8e

SHA256
bdc98deefccbf2274c519ebbe91e3c17905bb8b0e7becd3d4c2deb54afae0bec

SHA512
22a69b1f8a00d688b994cac084e514876bc7a9d3a4f0c4fa9cba69e9c88749531edd22936282d165c06713fa72df1cb7f278f581ad95aee26b5b565a66475516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec4b445f-41c2-4712-8cbc-cd2d7e15cd16.tmp

Filesize
3KB

MD5
df508ba69caaa71011c243ea4d4ecf33

SHA1
cd5111596b2af176edcee8eab517855d776138ba

SHA256
d9b92a88700b8b32554ba7fad5ca8eae3f71c066c1e6fe43a91688ae2bb38672

SHA512
35c079f3cb405d2ede5d61772b44c79451f2f168282b66de31e5112f3b035c3b546026751b1bea8ffb208f607b7ba5efd28c27ffaf75b72f1a29342399ab9c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
61bcae5d476ad8693cd1f3e33d6a6e3e

SHA1
05873eb2bd12270f3e745209805893649529ec2b

SHA256
f73f1ec3fc86ef8ac955ec9752f96a9e8f36fe9557b24afc22095a338f267806

SHA512
0d4f2a14941a518e6a3d288abbb7bd8600235a5654e9386f9891eecbf8db5c1554a96bbc4ab6558209c606906f314e3a14a293c49709e7815783a29d642fbb52

Download Submit