hxxps://drive[.]google[.]com/file/d/1YE5lT994prZQl3lWdp_ficIrlR8VR0_m/view

Analysis

max time kernel
50s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2024 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1YE5lT994prZQl3lWdp_ficIrlR8VR0_m/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 540326.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
2172	msedge.exe
2172	msedge.exe
4296	identity_helper.exe
4296	identity_helper.exe
760	msedge.exe
760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 244	2172	msedge.exe	84
PID 2172 wrote to memory of 244	2172	msedge.exe	84
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 3988	2172	msedge.exe	85
PID 2172 wrote to memory of 1356	2172	msedge.exe	86
PID 2172 wrote to memory of 1356	2172	msedge.exe	86
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87
PID 2172 wrote to memory of 1040	2172	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1YE5lT994prZQl3lWdp_ficIrlR8VR0_m/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb70f746f8,0x7ffb70f74708,0x7ffb70f74718
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14161462772514231932,236330488440590317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:5292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
d250661398865507a497d5aff8c6adf5

SHA1
138a59f697883de193988b4e1e20ea1b75431d94

SHA256
14df1ef08ea087ea6e21674437835a0695de98266fb5a2e354e0c4209cf7a135

SHA512
f7a36e118b9ff06850528de9f2c2316447bea8be28feb8ac5115e013471ce7ceca2faa4d78405ec3f70b551d41763b430104fc88880d092e2f078ad09c665d8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7dffc7b3afbb11a22b05fd142905a0e9

SHA1
6d076d4ae7d0b1423eba260c1b5dc6ca187c200f

SHA256
9175fc0c33ce2ade3249cf64068d6709492bb41fa1b7c3fe8db710077daa7e97

SHA512
54495285d088188561e067d4ebc49839e90830510f2e55af98d884e330ea866df2c276458cadb56c4fbab48aae07dcbf32da7a1747cd6a18e7efe95c8f359284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
12eb9941e87cbb5d4beaed17bc78c75b

SHA1
ed3f028474ba53cd6a31a249e9945f42469256c4

SHA256
bfca153be542e3e9f8c7d528ae528afff68e9231aeb63a4c4647bfeafe980776

SHA512
e201983ccd414ea003ef8cd24c734cad5b96f7cdcf29bd2206162df1a299a46383711957b4af307769fa327d00bc4fce59bc38d2a60e3a6e88ee27f1043024ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0191d1e60978332df23d079c6abd04a4

SHA1
875c773468a323cb8dc2afb8e7a03c3e1b6e2c03

SHA256
1ab721172a4e8d79d8f7c8dbf39e20b9e6cc0a4b686230cb771635b3577922a5

SHA512
11cd0b3a34bf923d7a04f53f26085fbd9368060651c0ec2742f69704649d9eadf9826aa0ee99da0b6058da3e14a354b37cb29f7dcdf65b7f3095e9550a31d6d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
73eba317f29c0bd968910861da29e7a0

SHA1
d58b06904f6b47cdddbe4f2017b8250945ea07dd

SHA256
1c5d81a5c5cb3f3a1a82ac60495315955a2538c2a9590d67402cc850035f6b69

SHA512
6d25028a23b3823829c8b42dce7d06009dd5112b795bc9b930f08d88877125907b210dd1f9af2b16f87b21da6eabcc8eb2887d04304d6e4bd2f7f9e5689abb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
12dfec066a2ab932150b294502f3a2f1

SHA1
86369c67fcff7c216fc762dcc04f269b2b7152ea

SHA256
971325884b2e9aca60e7c89fcad1c612eaac45c2c75145dc2dad179607ab0104

SHA512
f32b48591970079bd18b84494b1f7baf761e6a71e2981a98d0bb55c883f69ffa30454e4112d1ae7a29e5e8e017b21b2efb9157eac5ec1290ab38521dbaf7bac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585d4e.TMP

Filesize
874B

MD5
d4cbdb1c9e8502253e9957c1b1c31f0e

SHA1
c4c67d0b616d0c314d750460435c74b56dff2d7b

SHA256
cf98897506f017fc671c13bb273e72df5b286dbda7ed79d80458d1499cb2b95c

SHA512
d5196b035fdb47ff1bebe460c58fc7f646183b4d43da664a12dba00fd6904dca0893d232ddffce5727c8f9859f2733b821185067bcefd1ea55a7a1483b543165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0887baf920b99ad6e43cc1df25065bd4

SHA1
25a9a6059a6ea8512d185e241aec6a530ec3dad7

SHA256
cc0f3954e72bb6a6edf29c4d93508aa1a0f02070ab98073c73448d2854308bd6

SHA512
0e78ff811238c442d34dc2b6f281077896d5d3a1c49942d6228fdb280f4993a06825e4d2f71d888e78c495684b2c1a4ccf139ed28f78e384c583c2a20d11bcad

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 540326.crdownload

Filesize
100KB

MD5
002f84ea9760e4fdb4a61d515a578566

SHA1
cf2b6c06302032ea79685f4bdab974e6a3ca947f

SHA256
5b3a0e9c29be3bd7c2f4051722be188e87138e418b454d99282e03e22c98b75f

SHA512
acb204395fe9210363f89e110d8c9544b8da30d892677c76a181c62968948a63a77e7ef82cc6f46f12840a499ab490543c4ef7cedf1cac3affa3e68038c60c4d

Download Submit