hxxps://drive[.]google[.]com/drive/folders/18uj34N-Al1ktozSJJIju_lEZTskpNb0C?usp=sharing

Analysis

max time kernel
535s
max time network
566s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/18uj34N-Al1ktozSJJIju_lEZTskpNb0C?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
9	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
1604	msedge.exe
1604	msedge.exe
3360	identity_helper.exe
3360	identity_helper.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 3956	1604	msedge.exe	84
PID 1604 wrote to memory of 3956	1604	msedge.exe	84
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 1252	1604	msedge.exe	85
PID 1604 wrote to memory of 2736	1604	msedge.exe	86
PID 1604 wrote to memory of 2736	1604	msedge.exe	86
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87
PID 1604 wrote to memory of 2952	1604	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/18uj34N-Al1ktozSJJIju_lEZTskpNb0C?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9835546f8,0x7ff983554708,0x7ff983554718
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10938839356271095254,3222212194081166568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e10a808fced445536a6ec666a6c9ecc2

SHA1
31031b34ecd1b9f0d096ca07cf9b398544551b79

SHA256
960c00a4bf0a42ba6cc5b69b8b520e4f556cc62340680697e314a9cbbbd84e43

SHA512
3bb8394a71626c763e9ff52b978abe5647cbc3807d57e1c89cf26d4ad43fafa8ee3369d2702cd6882b318dd3727971303826ac5d75a788407f34677190e0dc19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
558ca2c16975cd9246d772656018e828

SHA1
03621e63df1bb671f036a81d8868cad1846c4b5b

SHA256
9b2a97ddda44b8295923f4d2e1e6ff6f945ca6d1a42d75688f6d4d53423f35b3

SHA512
be449fe210edf6673c086e996da801d2926f37fe1298fa502ed0e57bfc12c4d7191ad27c0aba9a37434466df192d21dc59d7598865b62833c3ff402e6c1f0f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
acd5ba05f17a108012ab66342c7c30c7

SHA1
196ab43fdfa0ab45401e01c484f19f9cf733290d

SHA256
e9a0edb36d43c8b3202aadefa413a43697489663f5b388c479c140e085319b83

SHA512
8749e47fdf59abf77cda429c89d831c1a36279ad2e756c1f9931f6cab535cd6f21a4c23a831eeb9142d6277255302d3b9a66ad95f79907a31a3ee8de2df5f35e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e1be5143a788130a8eee9801aabfcbaf

SHA1
633597a5e00affa9f91c1d738b3a38fa5caec426

SHA256
bc0514c1bfdc8559afd3bdd51384cc3a6e8849bb2b897ff5571842a5f21a4611

SHA512
19037d33a3b25102dae727745c406009aa9748a48fcbc5621eb19b26e893659fd03f5b1d71514e5d118a5d872a173c4842360a18b9477a2742c7593d0f9a1d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
130c332039b2789b216899ffb63c828c

SHA1
3d1d890dd17db78828896b334083ef6a58bc0de7

SHA256
0755a013ccdc3a76f9e7aaa68f86f4c0a9ad7a286af368739335a16fa7f32547

SHA512
8acff8ff11f190135c7f07d949a1d81b91e057e38eac63a7c02e28405946bac7bccfc62ae055c11d66dcda358fa0a83fa77e13abeae6ef802b3bd64566bceefb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3f2a3d7d02221d86af41a93995f8af2e

SHA1
d425625eef84dc179002c94f724f59a2de2743fc

SHA256
53b9b56ee16e803360cf604586f60312ade315a465934483b8764cd3e3daa61c

SHA512
916946c888ee76fa89eee98a0a03bd7881a65deb5534f8eaafac6c4bb01ec74f027d277e9e23de1aec57d0291dbaf74c8832a6fce96b715ad724e1c16ed68d98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2f9577ebff5b27c406cfe9b5b846ff1f

SHA1
e0653167c1e366de6a24b2e949545880b9a6f976

SHA256
5bd90ef9faf45b7a972c6669eec73fca7c1b18c3cc1c3234ea9c2f0bcdda14bd

SHA512
d43c0a0f41879ea2e015ba7ed428bdf57bcaf7223490791aa1d004f7e62fcd619b9c5280d013f939fc88d8102f3323c085a849dd0914acb325be1d6d5341bf8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
331bbb43a4c4be6975f10cd268a5c4ec

SHA1
91b53546049b7bc187487a71e700c077b90dbaf7

SHA256
f9f8ed5021a15a8fdb67e1528e3e0886a80c3c86c26ee25eb2b5214b173806af

SHA512
4b24123e7bdd91e895d720f515dfdf6424956c47d39687ec18d5aaab2b5e2907ea7cafa5c3853e84079e7872aec5529f496b5a353e9d0cfc5f75d95904befcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d9eb53c3342c804f372270b2bb968b4b

SHA1
f548ab8d77a473c12ee67d0ba115f5f7eb801137

SHA256
a64d5108cf463e72534c2ad379f969bc7c911fe9006a8ab3f44465dc9ac3efb2

SHA512
0f0dec68d81038e80993c24c04ff777a54fa6720d954d03ab702503206c31559df2e433b1cec12771cecf46a89b0fff80ce73ca53101e3593dea5f14a6c5dcc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d662e042b92e9b00f9de41f8dadd2dad

SHA1
e28fc98d09f1566cb720494b0c323818c4606125

SHA256
c412aec472b1a43179cfafae8658abd649371cf2220eb3a08fda26724c3e44f8

SHA512
dc7ef9eac6b6d4cf15520b262db1f70f0446fbaf3661f54158b4863a325d72cd6dda7a23238bf4b03989388179aeaed43e3c91d5a38957d09cf66202f351a2d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9e740926e1f68710bddeca14634c0c01

SHA1
15c1dcb4289d7bc5cf9028ee5fd41b5c953880e2

SHA256
090c29a16905376daff0956a0643e6ac826a216bdcf7ddd09f2c6a61ea645b79

SHA512
37f93c3f5ea858543e9cf268fb907d8718aa28aafd3f5bac2b6ba38e82be51a9fc3fc351483954b2c8803ad9da2bcdff8dd66b89245b678574d8c1d12e4d136a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58dd7a.TMP

Filesize
1KB

MD5
46f4c05991c871904e1f7e515c398031

SHA1
56123bc7d4da0240d394f66ade1514cace22890b

SHA256
d2177b644e3a153240bb557bd4ed419ac3e36e4fb60d6829d16cbcbf481a122b

SHA512
6f67c33d19bc7ee9fab68e3e7d0bc4ee50d282e26dd0c24456518c71d69b93680505901ef815ae2ad04f8d726d834c594c96c9b3ca4dd1bb1d389aab14389419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bc447e8d1343b264b2ad86eb92ef45e0

SHA1
d83a692cbca554944d49d82ac9b2746bbccea723

SHA256
95cf06f7e7fa5d589ffda74b99e472e5dbac5278faec39482e83b945fcf05f0a

SHA512
5ca4d9ffaced687b5b913cafa71d8d730e2527a7683310bc874ad227b9709010c3995aad44ed4136ecb043f69ae87187782dabb9e55353add94ed5d7524b0299

Download Submit