hxxps://drive[.]google[.]com/file/d/1Q8uEkCcr7RFJAgkUlqXatFH7sOEYzfjy/view?usp=sharing

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Q8uEkCcr7RFJAgkUlqXatFH7sOEYzfjy/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
3132	msedge.exe
3132	msedge.exe
4944	identity_helper.exe
4944	identity_helper.exe
3108	msedge.exe
3108	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 3948	3132	msedge.exe	83
PID 3132 wrote to memory of 3948	3132	msedge.exe	83
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 3632	3132	msedge.exe	84
PID 3132 wrote to memory of 4664	3132	msedge.exe	85
PID 3132 wrote to memory of 4664	3132	msedge.exe	85
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86
PID 3132 wrote to memory of 4592	3132	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Q8uEkCcr7RFJAgkUlqXatFH7sOEYzfjy/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb6b846f8,0x7ffbb6b84708,0x7ffbb6b84718
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7083960357276702800,3864289033455966326,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
0e9540e1f38f5597aa40229d3e766526

SHA1
365153cf26e42fcb3a37114fadfdb26f7bed375b

SHA256
a38222a867987e3ddd914d87e3797d9857e0ef2327bfcb7afb0ec3f3340537d3

SHA512
6050df19f74a8dec05c8edc8f6889c2cda47003f4d8d289c47e964afd3363d91eced347ec94fdc963e94ecdfe3075a39a0f6a34eb4bb090e5bfc79a6148a484e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0b952f20bd24b86b810189a96704e4e1

SHA1
d74769d2724ca2894a0e738227910978af62bea6

SHA256
b09f7d28935adad5622907d7b7754dbaf94e0ec023ad82a9e6dff93f9df7619d

SHA512
138a05d8f4142fb8d00e466899538b6b35b85899f0271021a6c5e7f7750f5770c70f605c8ac4818043bccb7d8c67a29599cba4fe48964198d1185d7cf525dde1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dd13143742853cae2de9e5c948c896c4

SHA1
58100dd6a738c9bcf1be8988557ba16b7d757e5a

SHA256
fc4e6a77d577e9b7b1767f841c8394624da54c58e97b039d327100b8735f82b6

SHA512
273f14f8225c54c8d5e2545469616a6dca1990d93d583b0bfd06add3fbf5a83a696332cf9954edddf076125f8e1e19884beb231b6c9a4fe961df4a458bc5e5e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf3140e8814045d93ca64416f06710be

SHA1
e436f932380e4e79b01784733960ba1e9bff5b54

SHA256
1bb033df5b96b0742fa9323a78153112aa3d4c6a62714c623dff5d01a0c81555

SHA512
ffc53637d45c37e0fd56b0a40c177127b354d94288572cdfca49dfe942a9d511dc9f6bf79c0d54447aca7103e431778d4b9dbae61d873144320bba69b9429b3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3e9e0690df28d21c93098e8d6496d791

SHA1
d65528230c790425007e460ae354b05e792d0e22

SHA256
5f02ec466f1fdf2b9bf30a4c80b71ab641c4dd22871aef40b4aa5dc32acced21

SHA512
f59c6c46cce1782a5c434415837fac8d4296fc598b0ec15cac67a4094e6003cfbda364e6f6c30da8108c65675fe5ee88872c9b676c9bb5f2fb97d2931f379e0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dbd8f95031d5ee787a4d704c5663ca7a

SHA1
b649e690565ab1c17ad6e3394c7ead1850d401b7

SHA256
bee61c06a80b6c4664d40f3df3cb53ae218aed654ecd9133b63bb79e10f9e7d7

SHA512
60115fb62259fa838704c6b927bc2e7b1e4111073479aeb7e746910904ac303c36473206815f544b693c45752b1b001273327a2290440c288d1da0586764a2bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e8599e69ea5cd1296814e84fb70c9dd

SHA1
e61db4f6a401875425006efb2a9ea18a21073be6

SHA256
c5d61088d017a9aa7ed4fe382a7827497ff58eac72b787790bcd78644284a236

SHA512
82fc96d87f198c4acda7aae47e581f1135195cac9ecf282e1c0b7c7239c0bb06cdcbeec722171012d7decb24244a2d91e436cc24978706149722959dc26726cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a98f4aa92af664d11f7e96bb161aed06

SHA1
1874d4f6093e7b02e11cd14966d3cfe18fe00d33

SHA256
cc6fce87b62b9cdadbadad0828819103debaeeda4c9103f4256f02f0ede4b663

SHA512
3d2c3c8b56dfe605f09adf8cbdc2783375ae51a513840a7b30574102f56e25ea12104828b36f7f13be68ba9d0223acee7ec8185e6c659f250810c45a3a0c94fc

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 437859.crdownload

Filesize
376KB

MD5
30f51bfcbd521bec4fc73d53431896e9

SHA1
4c4db9def98b39d05ccaa679e488e62f58c1bf25

SHA256
0249556c11fbdcea7e71587a9e081ea6398ace17b6fc497edc37d23b9dde6f46

SHA512
e7cf84f38916e3d16ddecdc1b4dc704f918848a586c9dfd30ebc86c876f746cec0ccbd644cd56d16e3c9dbdc23f4d13ac5f9c9587d618a47115bff8694106a1d

Download Submit