hxxps://drive[.]google[.]com/file/d/1Jk0YBCV5DESnMW3irKSyNW8240nK38Aj

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Jk0YBCV5DESnMW3irKSyNW8240nK38Aj

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
4644	msedge.exe
4644	msedge.exe
2636	identity_helper.exe
2636	identity_helper.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4220	4644	msedge.exe	84
PID 4644 wrote to memory of 4220	4644	msedge.exe	84
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2712	4644	msedge.exe	85
PID 4644 wrote to memory of 2300	4644	msedge.exe	86
PID 4644 wrote to memory of 2300	4644	msedge.exe	86
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87
PID 4644 wrote to memory of 2136	4644	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Jk0YBCV5DESnMW3irKSyNW8240nK38Aj
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce26946f8,0x7ffce2694708,0x7ffce2694718
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2418239130294366947,9302917678426985605,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
63b6a61ea4bece857d20cf2e376aaaf1

SHA1
2e8dc4bd83b7c6764bb9c4b4efe3044f749eae4c

SHA256
c852dbe6d71e25486cb0fb41b11a429b3e4a76f825efe99dbd8e7259f8d643a9

SHA512
95652954a66a163f153dec7dd77735d5a07a12d62cd124361f5d1eb5e59a3b9fdf730e1cd596859502418fd007d23503312f579b3f72af442d4a2f4285f5eeeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
8dcf13439f357633efdd3a5bb7df7288

SHA1
ab91af936fc916d9151b4116e117ab20a2fe61da

SHA256
1a7cd80b956a13236e661443ed1838276ac5e112e469b4119b6a1ce1fcb194a7

SHA512
7b4dfc22aa0bbb23881926bdaf287d06371cc1c46beefaaf2aa8f55b3a67e92460c84226f39c0ef3570c712f1143c2512dadef4f61e099c64858ac20d86d6dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a2dd365c00f160e97029068791bbe0f3

SHA1
8c5f1ea7ea2b7002f9a5c87778d97522270a3b06

SHA256
564aee954737879e2d8676ed2a51bcf32840e2d3880347ce9c5f67589f44b67e

SHA512
1ca2f5eefb683ea971c4bafd01eca306435d0e674c6fe9cebc3eb57f58c85cf223289733ea3817fd102872cad4404d96245fa84fad3172baad88c5b3dd88123c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
33bc5eaff0cf84d5eb7e4d885d21de41

SHA1
6b16c94904aa2639b95dc11919dd59379d542cb5

SHA256
0ad5780d9dab8ef9a49acc801302398ce6c071efde5533a5f704e0817f859033

SHA512
ee0c753f00460a8e630db44c1edba6ddc098f7849923aebd684267f9b3bd4195ebb0d03473a5ee9a795d08089003c151792e0eb42b56fbace8f708355b30b47e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
08266c6d4b4d3fac00960929f6075331

SHA1
cbcb3e12625916b1d198d2938fb7ecff71739443

SHA256
98d066d26089373979e19628a245316e52a82a7a26ec2bf33f777bd579ae9368

SHA512
64b3b2eb4dbef02fd967af91b790f4aec641f9eda198914bf5eec9b4abfd16248b1c7c5c2200cdd1320535acc1b359e80e6e1764777a69a8dbc6654b520733d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
495f3d844bb06c08278eef4697719652

SHA1
76dd3f037e3b5609ae8a5cc9308a952fbf612d09

SHA256
f82947d4565cb25e62be02e5f7afcf4bd0a08955002c3baae6161abac27fe780

SHA512
8a6621ca8c5983bdd0a772572136d09c28c8c9b63b639f1b5391d483a4126c366232d96aac5208dec3a0b630b8a1bc30dec19162c9f32b524282558bd7d0d14b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
527f2459327efbb37843f8d4a0e5df93

SHA1
74ca62fb4e8723ab59b5032906a594d37b4064c6

SHA256
4e443bac013802a97b5556703c4c3e0c8966c769fd25ee8711e996f053efbe37

SHA512
cd10217d343c7470fb90ca192e65d9e83967aac2be675f85294a689ad28607709fe975a356fdab21b284d239a47bdd50210a39149c79e9d2ea3a8941167e4f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
72844f3c24245673984a7311760246c4

SHA1
9942af9e24e551a5fcda9f1b274b27e19860b8cd

SHA256
96d72f7df1559bff8c356498497ad7b669e7b756573194852e00fdcbca9018f1

SHA512
3893bc30e9212c2f0200e3d66f1ff7b1319027620875c908c98819ae71e36e7a7b9ad509788a3805ea725eb1318a697dcc5c3a7681acee3d9391062bce5d0c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ad62.TMP

Filesize
1KB

MD5
5cee00b649de3e07b749be53915aa4af

SHA1
f81d368731ff8a4a33f35eb369b8aa075466a96c

SHA256
3fb13da797358051e65ac3ab847edd0ac693732c367c78ecd5cbca755cf0814f

SHA512
7de0775fddd868f1206be4d44cde76d03d0f6afddc14535294e2c1caa2d3e832de5dab4a7fb75d7bb2f3bea714b04a7caac9ff9caababcea961e53dfc4a6d355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
314cc780e425e8630e48da30d7e98540

SHA1
8a8760d2a6590acbc0d9e7441054e6b4d4b65003

SHA256
00e4f275d1c6e735382cd723adf7be80680cc13e8c8dd6b99c0e1c9fd8f1561d

SHA512
e5f4826378d5bdd5d79c261c811eca84918f97b376b707beebe6bff2ff7c491d426f435ea174077c30e5f6a1cd0f311a8a807266a128b3fd908c6bb29f088980

Download Submit