hxxps://drive[.]google[.]com/drive/folders/11SaDVRsywIwa-F-OaPTRhyw_wZPUn9bn?usp=drive_link

Analysis

max time kernel
57s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/11SaDVRsywIwa-F-OaPTRhyw_wZPUn9bn?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
2172	msedge.exe
2172	msedge.exe
5112	identity_helper.exe
5112	identity_helper.exe
5324	msedge.exe
5324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5972	WindBootstrapper.exe
Token: SeDebugPrivilege	1600	WindBootstrapper.exe
Token: SeDebugPrivilege	5388	WindBootstrapper.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 936	2172	msedge.exe	84
PID 2172 wrote to memory of 936	2172	msedge.exe	84
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 748	2172	msedge.exe	88
PID 2172 wrote to memory of 3948	2172	msedge.exe	89
PID 2172 wrote to memory of 3948	2172	msedge.exe	89
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90
PID 2172 wrote to memory of 3156	2172	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/11SaDVRsywIwa-F-OaPTRhyw_wZPUn9bn?usp=drive_link
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb538f46f8,0x7ffb538f4708,0x7ffb538f4718
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3140228111027003501,13947872495636521209,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:5516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5568

C:\Users\Admin\Downloads\Release-20240825T094936Z-001\Release\WindBootstrapper.exe
"C:\Users\Admin\Downloads\Release-20240825T094936Z-001\Release\WindBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5972

C:\Users\Admin\Downloads\Release-20240825T094936Z-001\Release\WindBootstrapper.exe
"C:\Users\Admin\Downloads\Release-20240825T094936Z-001\Release\WindBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Users\Admin\Downloads\Release-20240825T094936Z-001\Release\WindBootstrapper.exe
"C:\Users\Admin\Downloads\Release-20240825T094936Z-001\Release\WindBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
e71443ef7575175befed5baaeecb8fc4

SHA1
a771f4ea5a7d3b617d988a5e7516f84893f89d2c

SHA256
5afb41e83538b3326e43d9ea56b2b73b499c9c6bffef69fda0068a9b95517464

SHA512
2a29d77dfed5e12194ae5e2852235d722dee37f403e3fbd8aaff717d138b4afb30fb20438491fa7a893a6f87151f76bce48246a6c5fc41afb0fee7326bd0c6e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac225d8781dd70fdd9ba4c1e92a4284f

SHA1
16da3e1a8e9dec7772cc309eb4b4c1f4faa732cc

SHA256
0ca30a2d285cebb3fb729e4822e08770ed2ae29d9bdc8ce8e1c73a1b7827dfb1

SHA512
421a947f069438bda67a33430ac8f70756c22070f9efa01489abd626075ba5e3d677c7809f024ebf596b93ff7596f2507c6ab42eb53ec164487f5b72b6c75015

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bbbcb1fcf0c7a316464dc9149330cd49

SHA1
437b7058ca823b4892301b405c2fbef61968be66

SHA256
ceace9da9892aed468fda897d05db11a6ed692a0a3511a825153839f00f3501b

SHA512
f6701b13687a434d45dce31cb9370dd93a9ccb95f65162869e655619333d7e50b6572792cea1a6647aec8ceb807e2190848c6c9e965dc25a94a3c39cac7fc9e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9bd4f4f6865447cd4508b796a8f79dee

SHA1
e52d2b651f5d8e5612bb6182fda55a6a1b0c2fb1

SHA256
de1f1ebc968667c30e0f937d3211f8082ba86cba5939be97894723458d7ef94b

SHA512
eedb92a141069df382ddd28821c41f5e592a2d34a9a07fe0ab5a252853d366db0a58aafffbc31b7c28cb760da4da4b4fc68fca46e534ffa7a9d4789eb5675c60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff2f731af9879a5f74bf2704b52f7317

SHA1
47120d598fba486936e2f0a14b31e4623f37cdf7

SHA256
912bd2dbd63b66f939f95babcc42eb5fb05aaa893f717df71c2b67ed925bd3d3

SHA512
3a82b9e86d3ba5cbcd57e03229f7270683789dda8590dac14ca32446aee6c80aa0e3e18165ae4c02d44f99b027a3e25d94d87f17d99e76d85e1a95a548fa5aa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e6c6.TMP

Filesize
1KB

MD5
7fedcecc39ff57daeabdde2002230916

SHA1
d8b6c6c76824976715256d0567511b66ffb56b62

SHA256
768063c89a5e7f6ebc01b7a65e4e267ed458e70cae06c6b21daa329dc31dfaa9

SHA512
e54bf2c5e555491900a2edc24644369b69aee07ae62a0a89056702727cfe347c23712a6afd34fed9768db729c6625ce1f1c00452a4f315047bad2556ac03c9c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38f4b83791f1a6fd67da0318dec15c96

SHA1
abcad913108b76c0fc212b6b2bd4fcf1201be45c

SHA256
99b17db3f048d41bfda72d3eef83ca2e344f7291712f0b685b6d8e013380ed6a

SHA512
b5844f4bdd07e4a77196043d8d2e53894a396fc7a98c98a252f857419a514983c6387758691d2269fbed646ed40e707d952699d58553789b97ee3877bed3f922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60af46e82c6c0105b6403ecab3656381

SHA1
6e5fa90267bb3785ccb26d4dc467e9a8e33dc25f

SHA256
1635b1757bddcecd017061e7dd58c6202956b0d3071b311b2bf900e3c9d21bad

SHA512
291d0eb214bb76bf553b7b136b4a9e522cd28301279094b78a6605e3eb983fe4be2e0523a0af54f49aa2b2da29c439b715ecf386e37c5897466535896b031898

Download Submit
C:\Users\Admin\Downloads\Release-20240825T094936Z-001.zip

Filesize
1.0MB

MD5
57a2ef21e773e8c113426e6271a39be5

SHA1
ebb6f2392cbd184a9de1d12b525070f5f67c9600

SHA256
6fd55e621721d6e9a6d6fe1ab6e895ff3e8597fd4a09d2b1e7898db6d1f702f5

SHA512
172a9f91280b8e646c17f567af013d7d5d758c24bea60b882040cf7ac0f115609753471dd5d88981c8a9ec6a8db447ca6447b4bc714df563d62141a6cb105c2e

Download Submit
memory/5972-185-0x000001D45C0E0000-0x000001D45C0E6000-memory.dmp

Filesize
24KB

Download
memory/5972-186-0x000001D476700000-0x000001D476796000-memory.dmp

Filesize
600KB

Download