Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-09-2024 03:17

General

  • Target

    https://drive.google.com/drive/folders/1B_c0Bi3TlDZhREdimKILtmE9BKYkWYmc

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1B_c0Bi3TlDZhREdimKILtmE9BKYkWYmc
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc86946f8,0x7fffc8694708,0x7fffc8694718
      2⤵
        PID:680
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        2⤵
          PID:5052
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2312
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
          2⤵
            PID:1288
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
            2⤵
              PID:1112
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
              2⤵
                PID:2852
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
                2⤵
                  PID:4256
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1920
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                  2⤵
                    PID:4768
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
                    2⤵
                      PID:4528
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
                      2⤵
                        PID:2896
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                        2⤵
                          PID:900
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
                          2⤵
                            PID:4336
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5624 /prefetch:8
                            2⤵
                              PID:2892
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                              2⤵
                                PID:5228
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                                2⤵
                                  PID:5700
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1730285834946076230,898183264194904045,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1336 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2832
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4544
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:2964
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4240
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x4f0 0x3d8
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:948

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      9b008261dda31857d68792b46af6dd6d

                                      SHA1

                                      e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

                                      SHA256

                                      9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

                                      SHA512

                                      78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      0446fcdd21b016db1f468971fb82a488

                                      SHA1

                                      726b91562bb75f80981f381e3c69d7d832c87c9d

                                      SHA256

                                      62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

                                      SHA512

                                      1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                      Filesize

                                      28KB

                                      MD5

                                      4dd36552638146f0db4bbb586d77bbc8

                                      SHA1

                                      40eedaffe7ae31d329d039266ac9d0e684abf7c2

                                      SHA256

                                      f6834510e1a68c8ff59e74df570dff297539a877ae77f26438a729d7b4a3b140

                                      SHA512

                                      2f2fcff9cf628a64b0d92944fec0665d2ab361fdc670ec62cd69d4bcd48f39d93fbce17f60cbdcbc51752b536f6eedad2913eaed2f193c80bf5723284d366c92

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

                                      Filesize

                                      47KB

                                      MD5

                                      2b5dfb1918c67607a49e6f784b48797a

                                      SHA1

                                      a8830395cceb8de7687b3b751c6626546f307d47

                                      SHA256

                                      5aa5e0d95839092c4545fea0928eeffac76690e8adf533d97b600e97250dac8a

                                      SHA512

                                      eaab7c07e1dc33f43aae512b77a2217af2189aede83c97dc73f2be7a17da5b1a242f47c7bd272ab13c9513d837fce6ce0ed0114b27971543370413b2a9c5dcfa

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

                                      Filesize

                                      20KB

                                      MD5

                                      72fc190ee318eb59c0874ee688040fd4

                                      SHA1

                                      89a14922ee6c2b6beaf1ddada9751fa322de0260

                                      SHA256

                                      feff488bf894c63d93b80cc40c9453df0ed51f9f6dee091ec4ed9a818d433b1a

                                      SHA512

                                      5354176dfb7fa00dae430947c7d42d02dfa3b7601573732ac53352c5ba548c4cc7dd4bda9bbc8c43d85149ad73684e5ed527a59eced1071edea5e7cb30ecbf23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

                                      Filesize

                                      97KB

                                      MD5

                                      319c7abb19eb2b8d92b93821c3e51672

                                      SHA1

                                      858ae838c8e3e3c67887120eab25799165626f65

                                      SHA256

                                      942476fce685e8952c07541810cf783ffbc64d6657f911c25b25e88c157a3308

                                      SHA512

                                      0e297f60f30dbb310c9efba3c6740202c51dabc0b179d4ab98b28a54debf6ce4985f367f426098d746caa3d2df8eb5af456baf46491a8f96d9ab29bb2876d372

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

                                      Filesize

                                      753KB

                                      MD5

                                      2a283c0fc03a66ed6276ac8cd23b6c99

                                      SHA1

                                      79cbe1c0c2f1e3acb5e3d85970207024ba1c757f

                                      SHA256

                                      0d044d038870bdf1779be17b1ee25746cc8f39848a22b5960a8bdc591d042da8

                                      SHA512

                                      7d4126e07c0dce56ad44a52c21e3d12ebbf74336f51a389d2ed47b798f9a8ba1dd527072cc531f9a4dba1bc57003d865cea4d66cafacf7acc162525687990cc4

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

                                      Filesize

                                      24KB

                                      MD5

                                      3ea4b2f51ec849f83a4c315a8d7d56b3

                                      SHA1

                                      f31456bdcd645c3ac6eecb24152dc1e4b093da49

                                      SHA256

                                      cee38411fe5924d638010dea0ddb1d25f66bd1f7a0d1e2b2be3dcc8bec438d7c

                                      SHA512

                                      571a587930974325f8ca4b8d6b3bfa217355d0eb2070656df8fbffb44ddd3221144c1b20a135f40b3125c22b3b4a744162c7457426c9ba58701065d9968c325c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

                                      Filesize

                                      50KB

                                      MD5

                                      9f2ecb9b63c47171c67fc604844b377c

                                      SHA1

                                      088249c9719189c00488e3db346d7981d5987014

                                      SHA256

                                      5a833bdd9fb8d4bbe6d30ba5c6cbea816120d3a541f5adc4cce0e962597ce2b5

                                      SHA512

                                      10c727332cd1da1856e2816e2aa9b00d030cfd01e68039b05a05d2db935fab77a2bcd91983141cc7413ffe6ca3ea85b39d34f660806aff1d005294e17a750961

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

                                      Filesize

                                      25KB

                                      MD5

                                      b30c0df244d5b7d5751125f03626d170

                                      SHA1

                                      372aa543709c497d385f43aa2a493dbb3c76dbc9

                                      SHA256

                                      f18fb8a8cab3c8e69324b236a54e06c3bb08c3c4ee65863cb2782a97c63c0479

                                      SHA512

                                      5e7a6666e31fb65643019ab32139130ab7d5426de8ba5a903ac5463721f293d8077ab8516bc72475899b8f582e87233221c9b39f66153d4bcd435ff2cd185518

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

                                      Filesize

                                      105KB

                                      MD5

                                      c477664bebc60c2ee17c8734f9b26055

                                      SHA1

                                      427f2f1920fffac2b5045a52e4924a4b3f5a0a31

                                      SHA256

                                      a852ef952b266dbb998cd5f4785ddc0314e5ed710b4c9daa5aa8d850c7d29f88

                                      SHA512

                                      91dd1138b0c94712f7c114a89f6691b037e88da0e31c551d897814aa44ec66b0cabf18bf594fd20bbc5ea356ffcc5a8c91dd8c91012a28e27884fbe797d53618

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      1KB

                                      MD5

                                      37cca9ca88481886fda0e26f79b61153

                                      SHA1

                                      a2668331865935978bc053e99a8e812a9a4862f9

                                      SHA256

                                      e39a48ce762e418a76033375797f19dde5ce10193210dfa5cb8a95bc8236f646

                                      SHA512

                                      3c48351225d0c53d78573b8e5f5a53f28589112e37ac5c3dd18eb57955f9b94cc98a95c9a392e3ad02bb08b52a6ffb195f771172760b5797e8604c64c37ca480

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      1KB

                                      MD5

                                      b543d97557e26839e85791727a379dab

                                      SHA1

                                      78b7c0e327be91a6274403767b4e560a5a39789b

                                      SHA256

                                      00b506fc04fc42d37f742ad0313e3f8ff90def163417510fb4e042ba26f8b4e4

                                      SHA512

                                      b1c7dba2f8c950a54941c7bee83552b8cd0fd6148567b5324ad3c40fc020fbd683fa83311ed76118b325b81df7dff350e2c3220bd491be052137fe0322621402

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      1KB

                                      MD5

                                      fc450ff457e86d2c0da77709b1e092ae

                                      SHA1

                                      b2d91e7afcf540688e4efe3c5c3e281903d90bf6

                                      SHA256

                                      64ffcbb2d273be0289658423448e61fc8ee0c53b8feeebe0f57fc0e34c99465c

                                      SHA512

                                      33c818ba42245502e04c9ed84a01a2cb3d93c92580dd40238146f6f44f3907736325cd320ef2b769242f26168f3c4eed59f8242b2b5e065fbab33a6b81f8dd17

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_youtube.googleapis.com_0.indexeddb.leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_youtube.googleapis.com_0.indexeddb.leveldb\LOG.old

                                      Filesize

                                      1KB

                                      MD5

                                      208adadb367aa0ead137433fc867bcd4

                                      SHA1

                                      aaebe7c9fe4e272c52e8affb6eb017d7d96a6ce1

                                      SHA256

                                      9026ade0ebe15d4df3058cdae1f475442b41dcc0838e3ab8cd9a798791f8c517

                                      SHA512

                                      1eda1a1f4e0f641f065c413cc19c3961c6435f88c8cc6589cf74c4855f2372902daa91c5bbec09c9721b6d8a5928fd97ee5327b4bd3b0dc88596545be18a7f77

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_youtube.googleapis.com_0.indexeddb.leveldb\LOG.old~RFe593176.TMP

                                      Filesize

                                      2KB

                                      MD5

                                      6d4d4af4778fd13ba3176afc831f1b54

                                      SHA1

                                      028a6be7ed86779f6d8187b2aafc21eafd245719

                                      SHA256

                                      88e747a6e47fc8b0ab7e3668442a02f7205734443f3d79c64a82d24050e297f6

                                      SHA512

                                      c8792aab27ea1e978f5241a73a0e42aac985864abfdd316df8f71c94791ad9b184ffa2bb434dca297b3b20a41f63a3e94a7d9aa8c506770b86cd7349bddab66a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      4KB

                                      MD5

                                      a872ff4dd943c329be3137ad65ab9745

                                      SHA1

                                      098053ab22f1748ef2fd7a870729f5d270ca4019

                                      SHA256

                                      8dc9f3c851fd840d4f6dc3ce4d8b1fd9fe5cdaec6c083e9f63b99bc6f4062a97

                                      SHA512

                                      6085da9ad3b84d5321edec7a0c2b10140ccdbf0075019155ab09f7932dcc39c731b560cfbda0adba32b842145c51f1159b6fb3cdb8c20880d7a5d756955b15b7

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      5KB

                                      MD5

                                      1e0e1d98d00b1e58b4a0f0bd5c5a7f0e

                                      SHA1

                                      794f8aab6c167241d283dff2b12fc0d21d9f6510

                                      SHA256

                                      b6991c47f583e23044a27b4089cc06c3332ff70a4b5a667b390c861119b330ab

                                      SHA512

                                      e39770a8f6751b044bcbb12060b1164e34fca237adee504d97ab505f48ea3b00b2eef0ebc318816fef0f347320b0f17eeb21ee84feb3c1d2f9ab3f6b82eb57ab

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      db9b90d4bd0a1e2b9dc333ec0cd3f618

                                      SHA1

                                      6bd4c8f4d09bd66be7eeb9635e950229011f41d1

                                      SHA256

                                      621092c96c70a19ce4cb1cee53ed3b8a11d2b04a9131fe636b03b267c62eca3a

                                      SHA512

                                      1a4072b81cf9407cf6f20ae9a7242b097311af9e686ec785183d03ca5430f42181ec60f68fd328b0cff0fc3967c0d188e729b92a79afbf9329c01e058cc0330b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      d31eabe58f2649c5a77a0685e1cb4716

                                      SHA1

                                      3fb5f6debe2ab3310442f0c283c4eef254bd5573

                                      SHA256

                                      984215c9fb421bdcec4c3ed5292e7e822b9100230851f9d397689fecd33035fb

                                      SHA512

                                      b7c261462225b114bf1fe8c085294f76932f4c480e49a4b224889e73ad514cd246ab95d26a30029e2556ce32adf5567ed4d31b81c551b093f153ad0691ab7b0c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\848ce588-7f57-41d5-9733-48a8be3a1b5b\index

                                      Filesize

                                      24B

                                      MD5

                                      54cb446f628b2ea4a5bce5769910512e

                                      SHA1

                                      c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                      SHA256

                                      fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                      SHA512

                                      8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

                                      Filesize

                                      97B

                                      MD5

                                      1e38ad6bd3c47ae8545eed88f7ecbda7

                                      SHA1

                                      58c6b5a9c6588f50fa745b57b887b27638862d00

                                      SHA256

                                      2dd38ecbc34d28cc354770755a48fb7f3d8d0142bc062e473224ab793edc117b

                                      SHA512

                                      8854af7212f3bce323ae6b0762e40585a32c08a74874bb30869a579b12288319f96c14f6c4b128deb7a0aefa8c6f76d666bf245e9072c092b767d760d1e41b20

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

                                      Filesize

                                      33B

                                      MD5

                                      b0195b619cd45d0f8af48fc59c3d7716

                                      SHA1

                                      d153ae8be73da841309a68f26d26642d05ac20cc

                                      SHA256

                                      37bb3e6cd75d830156a6934fa1d1516121b37b4a220705fe32adece7b7ed927e

                                      SHA512

                                      6d917a97131baa380386bcf2c83dffb97f832e85f9510db3df4f7cdcc35396da58e5e098fbcf3fa7867b7909c09158d091ac0432919ca685ca5c7966b88a23c9

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

                                      Filesize

                                      97B

                                      MD5

                                      639859bd403e06c0088d4a26d2d4395e

                                      SHA1

                                      50ffd5228e88b42a1b3ee10cbcda1f3d262f39d1

                                      SHA256

                                      4d234ec3085b49a38c960cc0d3bd824431bc36a851e9750940746ac5bcf31ebd

                                      SHA512

                                      474da12fe6348d1bde233cb5c8a511cb40dc84b361210dee297cf3a1980a580b29a91ae002049c0f67e2793e7b1ac3796d5ddf5a6f799f1955f2c00381dee786

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

                                      Filesize

                                      97B

                                      MD5

                                      de435d0025b070b94ca5bade8a90bdca

                                      SHA1

                                      665ef6e977b5fd991f198f811450947792cffa3a

                                      SHA256

                                      d8bef2a37571f76f8a69ab70f52bdd943d3e45d19a0a6adb5f54de769552605e

                                      SHA512

                                      a6cfaa87deb2f155bec9576c97eb956521c2f0f19081040b80694ecfb054f72277ce0289dcae16cf364c1d73c8400e314c7386c73d814b32f7befc16ff2f5c97

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

                                      Filesize

                                      97B

                                      MD5

                                      4ddad6c9748dcae18e5008217dea9a67

                                      SHA1

                                      76a0615b98d57e48c787d33360346bdce87b2d08

                                      SHA256

                                      03bee92fe61ec94aba8c63e6bff41018f1d546356ad103594737c16d796cfd5b

                                      SHA512

                                      92ddfce8226e3e85f8969b71a5286d41c3e32c77bf073fec1cb0947eb0651d2bd4fc3ef78e40785608ea051717637ca5269fc6e54d2cb2db958730f75cd01d38

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

                                      Filesize

                                      97B

                                      MD5

                                      c612b9cf17b6ae0ea84d108a1a381e85

                                      SHA1

                                      f26ffd7acd57e80642b3da69727aa9f1b1a206c2

                                      SHA256

                                      c78ca074c9f97853ccff46fa1f3c848475b40de2a7c8bbb775419867e3408f8f

                                      SHA512

                                      25ba87770c6dd5adc36f685ecc81b9931f855ddaa25c6f828a907cae64d648daedd0a256a28519b4d417d21e171b0fb1bda085e0cedf1e70120ff5512d6791cf

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

                                      Filesize

                                      97B

                                      MD5

                                      3f59e137477a1496d9760d4c4b3f2a43

                                      SHA1

                                      f7578aead1585d46da38043e5452806badf9c55f

                                      SHA256

                                      75b7a183e8b3b635f642c3c608f8adfcd202998cdffa6e8dda4348d04a281a16

                                      SHA512

                                      7f2e3a64cf65afc7b75a3bf87e057fcdd8824899940e26d92d60f9f24526c58987a6b96d7d3b94056aff77fdc427444a31f3ed3a499000e152d6ed5d767f5fc3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

                                      Filesize

                                      97B

                                      MD5

                                      64fd138398d2d6efaf21464cd48d796f

                                      SHA1

                                      ac77f4cb961837c379a6d3c338920c6bc6dc39bd

                                      SHA256

                                      e4bff70d807fa82e3ad6aba64e28240d4a1092e4672671a3afb83aa196108b37

                                      SHA512

                                      015ac3322e1d8565eecb7368aff04de514756c4a3ec1933fd467f55f28ec1070b772f446bdfa0767f8b8a06b220b94ce35e7fd03cd4ebce1698c4cadf4a80a1c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

                                      Filesize

                                      97B

                                      MD5

                                      69edeea373a306845ecf588519af6efc

                                      SHA1

                                      02e28d84fbf4227993184745cdddd7c4b63da06d

                                      SHA256

                                      95d508149b5141e5e6ea676785f43cf92a538918d6ca8a24bd01d65189de2bac

                                      SHA512

                                      5cc8e10db0a2b1db189a5913b80c45c99941f2ef19c99926b116cb35192089716bf25bb9f1047fbd37f578776df31e15c5a59e46367472b4dfbfe626eac0d824

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

                                      Filesize

                                      97B

                                      MD5

                                      209319cdafbff417122fe9e76fe6c2c6

                                      SHA1

                                      0df6b1db28953c53050dd4f69227cbb1fce3528a

                                      SHA256

                                      103caab8791dfc0e3ed0d8c8df55068a1abd148a53576a565498b347be7c35da

                                      SHA512

                                      92977a3354f509ae98a070325991515447956bf86fe681efbd6c644863a035c8fcb88e33d3455e91485e651403961e9326e4ca1e6f38109b137de42c77be3e11

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt~RFe584215.TMP

                                      Filesize

                                      97B

                                      MD5

                                      5049b765d7a47cb1526dce8d132ac86f

                                      SHA1

                                      0c7536e140d4bd67449b8207de5461d304e246c8

                                      SHA256

                                      01820e940882aa15484a2ef011b2d9b69511fd1f81d8585e9efab6684b010fbf

                                      SHA512

                                      b8bdbc35f5519de082d5498439fa5b5ba9a06534787a749c66f643e31154eab644a1169192505a745f89ae1b2eceb3281e11189a18aa1b8627e7ea22b520d59e

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      d4ce089111e1e3db38d8bd124abbef91

                                      SHA1

                                      af1423e0d527b741ef9e51d9459cc01e8a83d018

                                      SHA256

                                      9ec56376b5df80b10693c9227d2ae33b1bfbbe933c039364c753de669d93e923

                                      SHA512

                                      5e9ab80004b04630b4c2636e1f1bb2c9cdc22f14b3386c460a1e10903a145220cdb0e04c3dc36334e3e387056f581d98b88b0b6fc31f33b7583a18ac83046763

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      a238c062b1ca91ebefe8ceceddb1da53

                                      SHA1

                                      de941b1a1d8a20c8d9ad73991a0878913abf6898

                                      SHA256

                                      c31bf000e804f8a74922a2f5a75e8ca73873b515aacd219aaa7323935a428485

                                      SHA512

                                      840f48ee2f1584c8bf36e7debf9427bf8ca2a18879f7b6d3927d139bc182d5ddc05bcc70a1cff8a576c09ca87d11dccd270a4944dd71c9448af808843b5d6d56

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      55560b838ac96e2be187de21cad1ab01

                                      SHA1

                                      3361aef7c9514f5786bb9f0f83db085a77b54c0d

                                      SHA256

                                      424c4228a503150cb2133fa99efe5108773601813c694a4edfa1e503b1761049

                                      SHA512

                                      9765d85fd1c27e4e0aadece127ea8188e1157a1f756b1cda7cce8f73a9bc58b5e534abb76d985631c79063ea3c339f8a15beeb07fd29d06beacac24b01d0d878

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      176347af49c6aa9294562750830ef8cc

                                      SHA1

                                      167d9a48d628da5a647aed80419581833594b838

                                      SHA256

                                      33ac003467d1febc614474a643ed6d887d9542a1d87f6b675a77b3fb528815c9

                                      SHA512

                                      96155c5c719a3c75237b652d6b7731fb6c1bfe802dac4a1ca5e65b7096a7d747ff2c3fde875c96c337c1986a4028ce75854dcb4f2ad8b69fc08a674bf7f8f5a4

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      fc99f00d87000f8ba8e6fb6cee1a8f13

                                      SHA1

                                      00f9e0cacf82ffc827391475f84a56299570b690

                                      SHA256

                                      71f2c417102cd1af7ebca16044fbe97ede9baf9ce30c17b6bc3320c59f2b4cbd

                                      SHA512

                                      3a69959d74755df243d0873e70ee354e4cf0a623dff51bc4d1e5f6fcfee91550c59be40ee2da68935170af858f8a22aa29ebdbb9550bcf3e93ef2e34649a98f8

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      566b2c1ca6cc71bfeafcb3b5bd0cdcd7

                                      SHA1

                                      ed8f70b7a0c95cece794f1a4aa13e09a1581969b

                                      SHA256

                                      aadde562bdc11c27a50c11878d8cefb42967ff1b5f888f5de59e8afd7ce710a4

                                      SHA512

                                      97be23b53cb5ca882d16b905b63ae297333295aff30477ef8f0daffaa80f0a239b228032a3bd287cf712e5d625c97a991e36ebd97f1d211cf54d53b45d268fd3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      ff70395e8e1226858b2f719d01e5065c

                                      SHA1

                                      2d2d503e79ffc9a697a3788ef172bfe928ca3a05

                                      SHA256

                                      effec37e6ef152c28b0f1aed3ee81b71f38d18ecd6f6c28450bbff6f0c7a1d94

                                      SHA512

                                      38a82dd31f50cf712e16e91394fa2bb3018129516d248ad267eb2bdd8b0decf2953c05700b67bf13802540bb5bcb6e868b4c2295d82e7b020b030be8387f8746

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      9e1ffc46fa5eb7d3b2c5f2d5eedd1c41

                                      SHA1

                                      e39bd543ca44a13abc61878d035ff8eea24e1513

                                      SHA256

                                      3878fde32fdc937706f3a8d59a008f454c3c201d11e01f68b41ffa6efdc62808

                                      SHA512

                                      673e06bcf0edd5feb568fcf12d4f9c96b733814fa8c4ceda497025f58645072a5765c7079421797bfb197f8d0a72f3d76b7e2ca84b98f4ed55803675b408d0df

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      a2e63c288c95901544a18dcc4e276f3c

                                      SHA1

                                      20a6276261aff463fa715960eb25da5a6c683ee0

                                      SHA256

                                      dd15a4a0da27610448d5c1970f5b5ef50abc62ef964b5410b33c9a5515aa8e88

                                      SHA512

                                      c15c9418bfc7eca6063d8709159cd0f55befe6730fb87c7f136f3327c2e6d026e9e06ebf737f77abf9d195440131810ec6f4b40b95fcd6c76819521f4ec0d2a7

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      caaabfdb58d2a3aa6ebd797520c361ba

                                      SHA1

                                      65994ac9e4b07412f83a1a7a6231172c083bbc33

                                      SHA256

                                      100f4b4683aad20cf47d984163e797217db641dbc7e65ee95bec1425da8f95c0

                                      SHA512

                                      459ebc5cd5ca75679de9603a33a883867c1c03f46ac42880938415d46a0622e44fd4e32a399b33c1bfea5e30a01b582dbf3566726fe6acaf4d71e63d5950feda

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      b8cb8349a27f0a8a10e34275f18ee31e

                                      SHA1

                                      fe7edb3a05a06ed7fcca46318e1e8be5754180a5

                                      SHA256

                                      56bb7ff1e911c1e0529536fd431ff776b6aeda960fa601f0a28001bd9a0acbe0

                                      SHA512

                                      1fbdf55dee9e07c39626886ccd3e65f46211a9346216626d56963f00903e2bc6c0868d055a7215dea2a9cb385a5115f0fea9d2ff21fcb7c4ddf823862ef822a9

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fb19.TMP

                                      Filesize

                                      1KB

                                      MD5

                                      95c0c199baae3cb69ceae8dd909e5dfd

                                      SHA1

                                      54c4cfce2df5976b304d184fea9473dc188e1c6a

                                      SHA256

                                      72efce2f40d4b13c1634aadcd7885a3a29a4da5a7cb24bab3460fe5b93eb4a32

                                      SHA512

                                      1a68f08206c327aec37a8b9360bad19ff119f795484bb8fe8a7e2d528afb310288233659582cbfa1b04257db9ac65ce704450660e39e3de1a549624162640973

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      311b54c7558c39d5bb7eff80b9335e4c

                                      SHA1

                                      97be39c65bbc8f39b337fae297795d8765657082

                                      SHA256

                                      2804bc18ff7ad1efba572200ac5780165f25cc882c8088a19d43cb8df77cc443

                                      SHA512

                                      64489d4be531b872b75b96f4653ab5fd922aefcbec0be325bac9e21398a966fe364ceb4790c365377d0a078497389aaabc85dec1bcf9fccfbe431534784f607f