hxxps://drive[.]google[.]com/drive/folders/1bhBRHEc1pstswyQzyw513K1TM4C0jDp8

Analysis

max time kernel
428s
max time network
433s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1bhBRHEc1pstswyQzyw513K1TM4C0jDp8

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1484	msedge.exe
1484	msedge.exe
1240	identity_helper.exe
1240	identity_helper.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
32	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3596	7zG.exe
Token: 35	3596	7zG.exe
Token: SeSecurityPrivilege	3596	7zG.exe
Token: SeSecurityPrivilege	3596	7zG.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
3596	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3612	1484	msedge.exe	83
PID 1484 wrote to memory of 3612	1484	msedge.exe	83
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 3132	1484	msedge.exe	86
PID 1484 wrote to memory of 1228	1484	msedge.exe	87
PID 1484 wrote to memory of 1228	1484	msedge.exe	87
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88
PID 1484 wrote to memory of 4876	1484	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1bhBRHEc1pstswyQzyw513K1TM4C0jDp8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd77346f8,0x7ffcd7734708,0x7ffcd7734718
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2208,16782713667633746216,9294484098531099559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:3988

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2812

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap26921:116:7zEvent23103
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c7e0e87-eaf5-42ef-acd0-7dfae15413f7.tmp

Filesize
1KB

MD5
37fc8985dd3a7fa0bcb7d1ac883c3572

SHA1
fc767b16a5547c692eb947af01a0c1cbef4186a6

SHA256
3c4bb6da8e1762e80af937627e828ddb282e6a168f7a28f551ffa2647a4d7340

SHA512
ca3133f71287dea6d90f7975ed80d4c88fbe8e2e858dc4e79fde63b39e5cffc696b0311cc6f5f3c93ca379bc491769a90d5c0ceb0537c3dadaf19b0e2d28e814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\53ef4bf0-78da-4fce-97e2-f4145ccbd285.tmp

Filesize
7KB

MD5
04a5cb92f9a60d8df67246fa6664019d

SHA1
aa73724a218413384b5ee78a75ed17dc904fec13

SHA256
745d4b451e0a5ebea1f8b5694de8e68cae59c26a60e364b8687043392fc66550

SHA512
70a41ddac6ae65ac7161ac0d2280c2c643b157229e1756d97c4a4ccc79b4c85c93cf969d160bd8978c09926063f0395dcac31db7a451c1b5025f217e4915a7ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
28KB

MD5
4dd36552638146f0db4bbb586d77bbc8

SHA1
40eedaffe7ae31d329d039266ac9d0e684abf7c2

SHA256
f6834510e1a68c8ff59e74df570dff297539a877ae77f26438a729d7b4a3b140

SHA512
2f2fcff9cf628a64b0d92944fec0665d2ab361fdc670ec62cd69d4bcd48f39d93fbce17f60cbdcbc51752b536f6eedad2913eaed2f193c80bf5723284d366c92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ce6e95eb1ab5101ce6f202810ed516d2

SHA1
df10d4b30fb5ffbc95575f6fc50c807fed20131b

SHA256
90dd57149b236266e1e949f4bdb06442ecd9662159c9774b5ce8d0918ce0298b

SHA512
eae86fc3dcc66318619fb90dd34fc0d22b6cb610a0a90ddc0862ed727af673f5d6921f2c8acc0844b4b691bc06b798d6efbe9b4d7f7007b14582f322790c1cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4bb6af080bd8a3b1ce283ed4f04ad973

SHA1
f261b336ab777771fea5f4825a4ed43c6c37b968

SHA256
9d29c473e6c064456ec4f4772979817ecb0336d5ffdd2cd44bde386352e77c33

SHA512
73d028750600ce84427e61c411590b65f2d88d9c0fbaed46925ae8ce0609434f1727641e28ee11fe4d97e0347b12f2103d287eed18c54bbb1c24f3076976274d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
995c9e3b0510915c15fc83365424f261

SHA1
22cf620d554a3c51486b2c7ff3bde1d62efddf44

SHA256
3e2a9f0da7f4212e6355c62be247f512a2d680a98eb934cf26ce28a141ac1032

SHA512
236360be92d2dd3ed949bf68da8e4f9072740ab938e5ac9c242fd3e685e3d9f1c96a7ec1a10d2297e249f217a195da45dcdee4a9a6d9124b99f800f47b99dc1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2b04785a5bb017436283471cd6a4bdf6

SHA1
593ff7a1dc99f76154fec821d105d8a39af77032

SHA256
32ba7e5bcd19200558f3462fec544f736a0968e087274c13fe0e2f0a5b1f8d06

SHA512
88a3a2ce275b6a9530ae0ef2260912ed446983909f7b2bc1ca3f5b84c4b6522610f4cd3ad1a91113e4e4dab5a3c9d2278f9b0f9f7397581763f24add15606373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f05a832f667aabdb69fc6f1c19cb158e

SHA1
0123781ec4e06c6b109c98254028ede3e7efa512

SHA256
7b08fa80bae5ef3eb375d797ce01ee9517f8c0c273e150539e1ac5a24379c372

SHA512
83e14d2a88ca888762874fc1eee33a0f53c602a702c8b929b6e5ff0c43b0e9f10db81cb835395249d83b9bcb7c31685ca503aac9a78250d9b21d74d25a29370d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
15e09afb16a5f05fabb03eb9eac72b8b

SHA1
15cd0b738bc8e28b824d97c8bcc8e5af22e72089

SHA256
337641526a1ad31c8de1a758e4b4f3b898a8498e6e145202507ac2f708139b61

SHA512
2ef030d981511e340bddb014bb077e512181f37437c23129249ebd4a544f8c373878cfdd35b69a8f5424b003e3289a959111ddfdae75bcdda707fe7b7fdc647c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
8a6d4d98d39d6ee625c8ec986d514b11

SHA1
5ff3a25cc55a32ac3653407542306d5344a1f917

SHA256
f86ed2ad841ee6c27899fd068d0270d334c7cc6ce3f8cebd60ed3da0930ccf65

SHA512
355d9e2bd870b1687485ad18f89937ef73dc262e8143066e4a8bbf4906c31d859981f52c5dca4c618f6e5314cb9a2a5629da5c0e4602c0db9c1de36b9ac64672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e425a9629abe921770806098efbc1de4

SHA1
b8ea51e20babe7aa78330239ab64c52f3d655f2c

SHA256
a3ae9c1bc2f46fc85a3475dea83e97285f5a15fdbf134bbc4efdf0dbd54e6c88

SHA512
29241f675ee5dcb56e120323253a607d8d4227053878459b4102e107115482b8830f2894f831bbd78ba63d292844502391c393a413e0c277df1b60b6a322f673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44bc8fd7196bbff32f2ea0b51ec63ab9

SHA1
c889e2e201b535ef50235733fdb7a1c16504f10e

SHA256
ee7482138bbcd1ed64d1351afdf404d2c6911149f9cba65f0868dfa39eec606d

SHA512
458faec486af9613a2c38370bc4a85c60c02c273c969d79323d0b20fcc57a7b176b59d5445acbc0297fe57422db603274ee27127ecbd754d640b4656a50ecfe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
93703088d12901ced56143c95ddc3418

SHA1
0fbb37dfe13619d48567e0547e65bc1b8f1a6b7f

SHA256
c706a510f11b0302428c7e9abbe13d30037c8a6c1224cfb8b6778bdbc0745698

SHA512
a55a5cbb9b166e8c0b1cf85ceabe37a9e223962975ed96d9f1cf5d0940fdc214b8d438a68302a74395d35f26959a75c156fd56e019ed784e54f05908309de718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aa47d98c2ac09044f3dca70fc00143bc

SHA1
42c86f081f19222344c2d799d533184b8dbfb514

SHA256
8e56574a762df9d32fa506c7aae1304c8a88e4aa5111eb75dda237f4e23abc08

SHA512
7110e2c5f1b7d09268a88ad04b0bab681424727f6d20d0114adee69292f8e24294f4a493c3b4e5d15062bc75a7f3b62d33b10175b3d1300551022395e12c829d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bc85.TMP

Filesize
1KB

MD5
179c2cb565a5ad3f65edf2166b983ffd

SHA1
66f0b4cab47bbe6f1cc2805c20d4be6819a2095f

SHA256
7eb1e552d3c4d21720eea75a6096f88c8c2a8cbfe725fb22134eb5cc11de1534

SHA512
b19656e6a3e9f89bc07fff45a46f238fcb14aa6dd0bfb5dd91e6d216adaf14c4ac8f137654abe554e9bcf7783fc3d0a5c72af9f994cff2bcec53a34b3f91dbde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6ef7b17d5c3363103f5477618c407eb6

SHA1
b2d46b88706b2fad692fa81c19dec73c336ea81c

SHA256
e6a418952803363eff4977dc122709cf2d4f18840dd909c3dfed4ba9abab670b

SHA512
701505677848aa4058edee4a36667198d5859aaba3a1645af6963461cfb820a06ab5d7af228e88522f663e117da620bc009950211f8b537c585021d7e9892d40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0a68237106c9ee450af7632bf7815b6

SHA1
f968e83379521b1584548c4ddf8a2a452f7ef398

SHA256
a2f31158a15388c77bd24943f2b8fcc35bb144209db897a54c6035419e866bc1

SHA512
574f77066690bdc5e37ce259c4bc91ff8f13bc2743e6336d18ff51dc8465bb228496ae42375cc855abc42abb65ef193a0f164ebed8eff753e2372884ab02fa16

Download Submit
C:\Users\Admin\Downloads\EXM Free Network Utility V1.zip

Filesize
11KB

MD5
15757b5ce3829feeea2fb7cf6d8f46ca

SHA1
8b334814bc54ac9ad0518b9a089af29cb54f8d72

SHA256
355b6083f0395ff040b2b02b3a8ea12f23730daef9e002f4c82cdfebc7bcc60c

SHA512
c2015498fc82c055aaaa8fba83f20c5c828bc536e1041bd1a650734612314b47bb328fa8663c82243cee9e480a06eec1e00054a9a856bc13ac97668d77976ff1

Download Submit