hxxps://drive[.]google[.]com/drive/folders/1jG2-zMkR4Jjdzmp0Idn3xDGdTjEYa2aW

Analysis

max time kernel
103s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-08-2024 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1jG2-zMkR4Jjdzmp0Idn3xDGdTjEYa2aW

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
12	drive.google.com
3	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
1432	msedge.exe
1432	msedge.exe
2236	identity_helper.exe
2236	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3868	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3868	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 1600	1432	msedge.exe	84
PID 1432 wrote to memory of 1600	1432	msedge.exe	84
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 1660	1432	msedge.exe	85
PID 1432 wrote to memory of 5036	1432	msedge.exe	86
PID 1432 wrote to memory of 5036	1432	msedge.exe	86
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87
PID 1432 wrote to memory of 3620	1432	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1jG2-zMkR4Jjdzmp0Idn3xDGdTjEYa2aW
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe318f46f8,0x7ffe318f4708,0x7ffe318f4718
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1680 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3370345378091470603,12697461970284161855,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c 0x4b0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
36KB

MD5
eae5fc6db735938044a4741054dca29e

SHA1
5ad3a1d30f1123fda791830cd373b9d9041a5663

SHA256
967e35cf9787773151cb0a3945617f4a25b0232c8af0b8b8db30797426c40d3f

SHA512
a996760ff518a4781eb2d5b6074fad7645b1c06fb98d1dac86c919b67d0e04289790a7e45c57c22b8ac28421b46ed299ecb38d6d979711bc95bf804f47c8556a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6ab6703acbd4e4224e232ba45ab96535

SHA1
4d99eb826da9805ce741efd6752cfb8f16b18e0e

SHA256
7ed8b091c602990180e58c68f0433b9fec6c61f8df2b7c90cdc4f2526668b91c

SHA512
e6b69230b02c39df9801df977fe09257c9148e003ffd08e0668d5e01b44350efc875f0d3843ee8b28cf7bbf8953faa02216fdf17c6632b827b5e560b5ee02f55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
478ef1ecd5c6f3bf7ceed5d6ea68c4f6

SHA1
921eb7bc5aa506e0f7fbd12e917d7352678e43bb

SHA256
709f2421fe5cabfb2328a168477375e1b8377345774368c2491090ebb1107acf

SHA512
b2880c51210a10f60c189e3de005938653a3c2392be2730632154395aaaf96425b9abcda079db4af937a8cac6fa06c5dfc2cc453395bbc6e2951bb8e4132fdfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e1e4dfbc8450f27194b7f0cf44f3e126

SHA1
9d3e9be47dabe7ab71913c51f65f26fca041467b

SHA256
5d2c03656ec9981b5adc3cf340f7f5d441ac0a34e3fc5eb843df7dd25d34085e

SHA512
659bbdfd352824e7207f692fb19b56f9fd208bf19da732aba93ae1fc2109af4d34cfe60529b3bd8f6453253c2d445ddd42b31c038fea76d7119f1958e2b022af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
56d2113ffb8f880947876e7afe300fee

SHA1
bec8f749f10d889fbf99af02e8ca57c8f99ae004

SHA256
f97aecbfdb68cd6e7f75416bf0e6b8bba3834860ba2cd77982d5e8cba7e16910

SHA512
43220586ca922f6511a466252c600c8ccbe042f80ce2786c48cb989f9f4d6ecb491fb0b5fecdef002a34fdce9315e3f87b18e1d251f54fedd1abb556d37b4d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e04537668e00420ff39c115c049286ad

SHA1
2ba9095d994230451e3811438649563600cb68e5

SHA256
ef5f6b501496b5c090253e0155984191c5ba109d13523092aaa3b478c774dd69

SHA512
9e9c1cefbf3d47096ada67375bc02b2f3f5afcada1a7491919a97d5754c3a5c84ec9b03e47606d78368a5ca22dcff2034837db0de8df616eeaf82b2d9d65b2f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
349cefb15bc909289a20be090cc46218

SHA1
c4269fb35958ba3a4b737486c67f8afbfce85185

SHA256
f00acea1ff3ae51a0d009478888281b65a2e2ebcbe77849d82e59c4efe6118fb

SHA512
43e1ac833fd888cedb74ce537b016d1985412a40c9e37e27d8ca6ea582aee0651349662ad9eb5169108d44ab9e7174563f453f24ded45cafdb603d66a4a46314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fb3190e4ae2c8e8a408366cdfea31b2a

SHA1
c3a1af9732b011698833b352d8dbe911b4c3aa8d

SHA256
cde6ff7b031f348fab3d3a7bc0d44cca29c9e0624cce2fc0fa5d781cfd0359fa

SHA512
42d79a0925380b6e414fadf30db1fea07f25c7d7afe9d0c74e23d7bbb6dab676f7f416d01594d10fdfcf0d8d7a75e5b0a70a5ec4447dbafee236ba0ce94be226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f365335449077f4df7d79c58596c6c21

SHA1
ca605151efaaa51c6bb9be74aef2dd2399211efc

SHA256
e91fbf99d9716a7b67273368d251877ded1b04895b90e7215e6d88b183114992

SHA512
b6344e5d63689c7c42fd48f17fb7eda73e7a322e23a24bf2208433a34e8b641f725ed288e3c2542799950a8715feaec53ccd310b099cdc1441af5318fbaf42f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

Filesize
33B

MD5
b0195b619cd45d0f8af48fc59c3d7716

SHA1
d153ae8be73da841309a68f26d26642d05ac20cc

SHA256
37bb3e6cd75d830156a6934fa1d1516121b37b4a220705fe32adece7b7ed927e

SHA512
6d917a97131baa380386bcf2c83dffb97f832e85f9510db3df4f7cdcc35396da58e5e098fbcf3fa7867b7909c09158d091ac0432919ca685ca5c7966b88a23c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt~RFe579412.TMP

Filesize
97B

MD5
1e798bbff2d9c10972e78aed494f1e62

SHA1
4cdfa350af58d51bfa60bfd230b72529b64cf2b7

SHA256
2506e5b88e1ec96997200f1417e04c1fa4608228a5c3ea9b90bbe5906f4780fa

SHA512
530ce2f88f3c338dc3437ab70160fd3624fdde954b11bfb6cfceee935ff67c70bacde5c511bad58ace0c28f80640cbd53873ef76bce413d448c10a971b965fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2a046ebcbb348e09a6731f225f3174d0

SHA1
cf256d07dc2a97cd5eb7378f2103bf0ca291e2ce

SHA256
2551a6a4e3c57f2392ebe299218e828d41453bdf6352f9bd96f7cdb396505d54

SHA512
0e0964398b630e920a71ad495b65d716d800fefc22d0ad5dd2c69630768509e56a3de616fe389919fa63f1d58fdaa365a37d553f907c840301ef6d38f8c70581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589834.TMP

Filesize
1KB

MD5
f09c3df451b04bed867c22844d15b347

SHA1
598327717abbdc906ee04c0ce03d1612f44de697

SHA256
35001266df9df6cb932b1b888932f245e9960c47a13375bbb9c01a7258cae97f

SHA512
36f5dcd89b9cb6569a8e00d188808f1e54023578842cea838777d692e20fe13eae2046e9f4cf48cf8169fe284ba8e2adf3cb2d98f35a0a011804f0367637fee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c059d56182b64c3b00dd539e2aa46894

SHA1
50a6099c4e00549a65ed0ff6bdf9a1d976b7a2be

SHA256
2c5a094276932927ae868db2ddabde94e3315d5e59052014352370861f58b1ef

SHA512
5ec92df5dacab398cdbc9d82afbf619fb4fa27b3828a212d8173eb7d0cd88e85a0d4119b8526709de90a41640a07ac00243e21a1d9fa39fb5c3b5adaa16fe215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0eb6840347bc7a9f8ffa76644ad53daf

SHA1
f551fb2acff48f03dcf8e9c5a4566c7052612afa

SHA256
42b0b98f1606024e3080ed3e37f8907e2bad88b21d518fe1bb51590a42dce975

SHA512
f54481edf99854bff204477b18ce54065932265d5db08acb245d8f9d46c1590487f4a9b1c25537890a6c652a2952c4076d9f605cb8599598b6b52de631b65c58

Download Submit