hxxps://drive[.]google[.]com/drive/folders/1BT8hterhZSMMi-pu6U48a2H4CCmwm4lp?usp=drive_link

Analysis

max time kernel
124s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1BT8hterhZSMMi-pu6U48a2H4CCmwm4lp?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
640	msedge.exe
640	msedge.exe
364	identity_helper.exe
364	identity_helper.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4436	640	msedge.exe	83
PID 640 wrote to memory of 4436	640	msedge.exe	83
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 2668	640	msedge.exe	84
PID 640 wrote to memory of 4772	640	msedge.exe	85
PID 640 wrote to memory of 4772	640	msedge.exe	85
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86
PID 640 wrote to memory of 2992	640	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1BT8hterhZSMMi-pu6U48a2H4CCmwm4lp?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbc5046f8,0x7fffbc504708,0x7fffbc504718
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1253710264549925841,13292199317978676824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5224 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
840B

MD5
872e9dea68b1377911574f3ea27897fb

SHA1
6effd64686240380ca8e415d7a0b935edf90e8c4

SHA256
68f31a3fd0dd8aa3b39862628f96544a525a0e170aa2a183a8b5db2a998ae2dc

SHA512
b0c149f7e382ed39e152734a950e78fe537fd46b79f635e36530ac1a9803eb1ece5145d365c3a50e5a944dfeb3b931b12a2705d817aca98f8258f63717e5ff45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fc827080cba93a346cd352b55ee2fa2d

SHA1
dc13afab338df9d768cb31089be56c9b2f9e4f24

SHA256
05664645cd39fe81cf8c9290b2e341b02b9600346360fcabd679051e74a698d5

SHA512
4979a91b778777bd035c2fd3e6de9bff5baf890317c5e013b9c08b4c2fed0f0e2066cd1ff0043a3a3238e7924eb2da28f99207132d5e191521afc6d701073672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
2a175a0a75467f2c5b0c901d7a2f9a2f

SHA1
9fc1e1871727e7042dd40761f72c24a3daa5690d

SHA256
efd9ad8eafbe66dd1a57d3b1088d64a76bf0d6f1bf66038d7aa45431b7184aab

SHA512
c4b6a5b7bb0a9a47e51ac5a74e3e1c42e51835593a908749f711650b0f6aa952afb3533dc83300e9e5cea13b87303e40169c97dfdfe7f56fe1a50ba95858ae24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
fe2fed9f691333fca99332ae441d88ec

SHA1
5e5ef46ca5f400e261b18b6e82f03104bc01e16b

SHA256
06d971a27df8d5c9833614355de836e026aa74ea5849bb00852ff17d63326380

SHA512
16de4ce5dee5e6ab4f050c691e7fb9c6336cb802b0b1414f3cf1e799474722c0595914fe43560fae5b665fc41431783e2734726e587b89e2666b5a52400d66e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
fd89239de3e13014db6c0f17423a0112

SHA1
518cbbc182df7f9c038e2070efd7075cc62f7a1a

SHA256
7c84c5b59dde5b901fe796c521f7b75f59c4fde2936ea4752c761dbcecc36cfd

SHA512
10176c14e3d23290dccd062df57c5f5129431d719d4d138362525755e382053356e387236fe1a15388c81f63330e3d146af2f355f3ae0d97d56867a3c4be68f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5b78374d7ca5479a8f46b0c0d7b88127

SHA1
7bb87e11586b82227852b52aea2cdc07f0800dd5

SHA256
a5ed1b5b66a61285f77dc7229ff27b44f84bba3a570c58307ae4a024bbf374f8

SHA512
498d46799d81492accc0ada903c87be6bfe45b40f7e995892d9ce27b0ef3a57faa4320f6d3a068b49c1798ac82a33faac0edc89692d63930b14c51a884d91915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b3cd575fd44b018f7e6e044615d6a1af

SHA1
69e9d91f86cbc5b60d37dfbd95b9f590daeecb84

SHA256
4c167e546d07f1f3e25dba376bb8c8a93ebc736e4071e65e3ed4d88ab9693609

SHA512
03440fe2c364b51ff627491e5c16e70059f8e9cc519cb79fdf0cd38cec5181a7b3eafe14b2fa80976d2cc131ac8dc21826a5327ddd282e10e318941bc04cae06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f36795d5ff440594f47c3fa34379af60

SHA1
8dceeeac5165e51c789a7b042cfb961c7c0965ce

SHA256
2197e1385d26afa2569964435a522f26b75f111a144b03142bdb7d39718a50a8

SHA512
ae89d76fe5e2892a51be04f01fad93f70cadbc24a92a21002a58cc8ab3c9534f240fb402f8dc89bc943c829e03cc6ff91f8ed98d2a5dad3f6a24ea21b596ee7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b1d98ba84b5b8138a00a129f7f23b104

SHA1
347e3e8a7de3a0e59a706140197b293740db0ab3

SHA256
054f7576049c700c1352b23cffa3e6431ec482435570219e0c66743fed6af428

SHA512
f8640d609dd113a483587eaa537513dd6e5676fa94c1186ed8396094638a56f4d64e09f78b3f87d8fdd814a3866c66a57d1f4bf8c0cb22c7b9988f5a9a19570e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd4452cd2817c03abcf335c7cf3b8b93

SHA1
e151e065d845e86dca778b8984c3209889740e30

SHA256
583dc796cbbedfbaaa72a555465619a3065b8c1f9334d36ab11e593121acd70e

SHA512
430a43a3f02f39f686f0a8fb2740d66fce49782f6881f0931da489f48c6ce83f3b85f9194309deeedbf23ca97aa2ff0ba74fd482d1f45567544fd236f5374645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2055f7adc47d78333f0b01ce26a56459

SHA1
c7e27ae50e5ee698995173008e8c9efd61bb72c7

SHA256
3a854f80699670626da2467eefd03fb1868b25d9d4de85d54b7d5caaab169946

SHA512
6ce10319c2daae3fc5758f0a6cc44b9fec0dff48008235c81179d5362a4871b1c7a9a657dcaa15e5f08156663efa7ee9140ac54b1f27b0f93208a04cb8ed9a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
4a64bb2a1d5d488d05b91d0bc20caa18

SHA1
32adbd457e6c423d622affb9fe63582a32e44769

SHA256
d7bc1fede5124613405d701739cdfd29dbf690211a6d061a2dc5efa05d6ad47b

SHA512
49b6270c15f685866e7407ba8bc1cf988782188ace60a82571c06e02089926cac84fa7a22b0c42bbccd64214fb62b694bfec32d14a01f309696f3712bca1ed6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
ca3bfa9a4c70b347d7d915b8a24c98cd

SHA1
226751503c0ae256b8d20f9d2f9a0c8ea145c151

SHA256
441a3039cfeb3f3179460c0555d3ae5829a4b01c18e4ff0ee007e610e54eb208

SHA512
8a7319d276477d5f92dd284c86682827a9be0b9830c818d5cf9a7cf04818481c8861552467da3335b0dc607710f51711794a2cdc7aae00faa258272af807c897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
ccd2ac81b15e26584297ee4314425400

SHA1
7eae34eaf53a20c2e69a361f921d467b9ee499e1

SHA256
4a4864e4f75230de19bef3dc64d9f43db47532d810e0cc2aa9f19be7c3e5b615

SHA512
91ea7c23a6b9daeb59a3f7fe872ac8ba93e019e09672c2bd8e41637ece10d90caec29976e74f8419ce843786e0d9cc425752664c9c951b12c544d27ddfba2a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
1d888197bf1505e7e289a30a1383e0d6

SHA1
4dcea2ecde052bfc24b7dd65c37dfd26a8b56566

SHA256
77ea2e2df612909d1851bb4b0914cadb95312fcba33bed7fcbf6e030102ef006

SHA512
936390b3cd6813656a3acc3f30765309a3bd9ce7d7634125dbec147d408581f2ba86c0986be4f87d258247a62e57a35ca518c56b8346daf039c3d72d33b1ae19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
dcc6a255f5698b47c35348498b1e069b

SHA1
1c7bcb277e2ddae1155f30babfb3764fe9c7d42f

SHA256
8ba0ef75c1af7d653b123eb94d3f94cb9a5ddaa70581df3173cb7b670e46d2f7

SHA512
1a490851fd3b1d9a27a26194dd5358bd9c0aa11db5d64752e9f390749751f2e04fc7096d276e57b8c718a652eafff7a4100248ff2c7a96756567ed008d82c0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
63830304506d3999a0a43ee76abb3b3d

SHA1
c06b6595eb4ac44180dda78417c7ee0f3fa5452e

SHA256
745d3ebec41716aee6d353ca434796cd19575a4ca52253c65d9a0dfe321972d1

SHA512
9bc8288a0d80cde3590d085b4b5223eee0303b11ce713255462e0220c19339d8a1af75b2c56f922c0d993ac590e239b576e0faa5317bbee0c8bb0b5b1ce6e9dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5828a1.TMP

Filesize
370B

MD5
045394d354235f6541413e879739f75a

SHA1
e5186451083f0e2eb1763f32d83deaed98de214a

SHA256
c2b309dfb08db848b9d507ed8287ece49e918576287752c768e2533fcba94aa9

SHA512
8c93b2be8f9c3fc12cc8fde45786ca2cda629d88cf68629d7c92caf16f90cb23c1aaf8195afa6c9cc21787addeb167aaec954018fe06ec283b224b3284378857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f6bef7f3648e980bd85f3b6ab41baad1

SHA1
391fc7b88bc0144083ea0d9258f3bc2de29c25ae

SHA256
7a05f1e983847939767d8a71b16f8d10ac1df3f15e421222eec6a7649f216991

SHA512
a801ece664a396c026b90eb564303b1f6cb81400de2111d4c65dbd11f452865226f60ea4e32773dfcd93f61117978bfe8a7143d14237a25a437ede49c187a65e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8ef7f460826af04811f87518941e0746

SHA1
9fdc055f9c6556861c0e8ae651faf4be70a63ff6

SHA256
27ce1c8c45eb2daa727dc630992787fe8126cefe89e69667c689c6576f38fea4

SHA512
9aa61d1b57fb64a648111a5e2ac92e866232273df27ed82cdd703e62a4a2307816f8a6dbb43125be1c4c6a97b659aae2b3d3e0114681b4dd7cf99a807eb97a95

Download Submit