hxxps://drive[.]google[.]com/drive/folders/1sf_-qytBilCKLCM-hf1Je1XWYmuOX8Jz

Analysis

max time kernel
62s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2024 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1sf_-qytBilCKLCM-hf1Je1XWYmuOX8Jz

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
2180	msedge.exe
2180	msedge.exe
3780	identity_helper.exe
3780	identity_helper.exe
3976	msedge.exe
3976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4628	elmeuprojecte.exe
3992	elmeuprojecte.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4436	2180	msedge.exe	82
PID 2180 wrote to memory of 4436	2180	msedge.exe	82
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 2872	2180	msedge.exe	83
PID 2180 wrote to memory of 3652	2180	msedge.exe	84
PID 2180 wrote to memory of 3652	2180	msedge.exe	84
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85
PID 2180 wrote to memory of 2000	2180	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1sf_-qytBilCKLCM-hf1Je1XWYmuOX8Jz
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa579246f8,0x7ffa57924708,0x7ffa57924718
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2176,14574702082304478000,10427956752452220026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4632

C:\Users\Admin\Desktop\GameLULE\elmeuprojecte.exe
"C:\Users\Admin\Desktop\GameLULE\elmeuprojecte.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4628

C:\Users\Admin\Desktop\GameLULE\elmeuprojecte.console.exe
"C:\Users\Admin\Desktop\GameLULE\elmeuprojecte.console.exe"
1⤵
PID:4404
- C:\Users\Admin\Desktop\GameLULE\elmeuprojecte.exe
  C:\Users\Admin\Desktop\GameLULE\elmeuprojecte.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4319d53e4394f4c01692dbf7ce8c4818

SHA1
8354c5e00a968d95b1041b0e2f6beb5ebeeaa488

SHA256
df961f2a9cdb00ea22ecb621578b0c7ad685f7cd68b2678b3ec35fa17e960f12

SHA512
600ce15a92094ad312d778e2cb9a52b1e8f4ec1c035066c52e158bb9640dee6c366d3ab53737286f13e0a6836131c4177ce63471e295fce1de38dd146d090500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
201b3c23d312431754a99a7f03aa7c10

SHA1
e178ee7a89ff920fe2a00e6cfa4967ca578d7225

SHA256
ab1d702f17055fed58c5e0bf98a34ca9a08918640e6b2316f81b97e39d77e821

SHA512
7f5a3619d1cafa2110baa3c4206c21290c40b1c660c11ead9c9bbdbc23ebd63c7dda546d9fd40d1a39490e766f6e2e494f385139df9c2a9fd1e8f6448cddd882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f5628a012e193322bbf3977db87fa1b

SHA1
ddcb2d5f50d2c4454507ff2e53c689563792da21

SHA256
bb40f0df5189ca9c2ac5193d68c887503c5fb784cf59b858b2143af078ca84ec

SHA512
b2344b3017f9c549bfacb81b3f6bf94abec4428081c2ad1c5320af0d4c5031adf41efa97f26b063ac54f0356b84577a2d2bbfc2091192044d7a1569936d58c7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a8263521c457afa77531a5f66a1715a

SHA1
b109be3b1b8b562213830fd2d89ecacf9dd59582

SHA256
a3dbd1222b7dbe821e76154ffcebf38a0d101646c458955969363d89f97afc38

SHA512
5b40154b5cff416b2dd88fdd26e1a3ecb434fd7ede3a0f2ebf05a244453836d36de5e91ce3cf99bdd39e27a0e4165a72a53fee31668525c1592c707097d251f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
10cf0ba6ed1f69f7d4137349975ff69a

SHA1
9c063043eb997a82142a1162c09a372d0d581ddc

SHA256
d3ca333cfed88f543a2be3eebbd04858bee9bc0d524c740d2263f4fb4905b049

SHA512
1c00fe6a8615c811eb68c26dd977572ec11413382717273c9d888d56f0264cfb027e5a888ffb6f431e04ef858c5e3d78cfd26ee1746ba268ed0a3cce82205aec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3ecbc767dad371fe8605487066d89422

SHA1
ab526b730579f2681ce73ed0bfb4e8e368b60a11

SHA256
291f623bea28e076389a67ed5bdc4bbea9eb19fc846fc04435fa3458f204baac

SHA512
fcee254c9ca9529d20a9fdd8ab0077b384425969483449a96b173e02be9b0f1dc670c6b86df51dff39ce2ba10ed0948f2cd80acf78a9af5963272828568bd958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ba18.TMP

Filesize
1KB

MD5
6ab7b2989a0f4dca98afeb9dd0ddecfe

SHA1
01766fc4b4d7d4105af1820b7b96e033947f309d

SHA256
9940e532122dadb73f49fb87d43b17cc4ead28a18ed9b5e6c7c170a03956822c

SHA512
283fffb89e18dd4a9dfe91ecd80aeaf26789d5c20a05220097349be44037afd596acab9e7f49ccc3e9bfe528cc84d21774dc10bafbb411b3fc2905c250f962c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1c77d598c040d8137e8aa4751ffbbdbf

SHA1
01a32454da941eae528d4dad0a25488dcac8a043

SHA256
2806a16975c86aacf2227e600ac43ec8cdbf63bcfcaa99aa5a84da504cbd0d29

SHA512
a7e01933e88eed5bff65e9634072fb00a44d1b01da341eccf6fa2f0f043c14f2437f8bcae2ef20c8a8fccbe6d83bfdf9a8e879764e045936efa4a816964b7dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f83eb0c7d6d7099c24abae36aff0d560

SHA1
166e7ca21fc6ffcbd5f7b26648ce7d4311bcc35a

SHA256
1d4cbcdaa49fa5e357dc9bb987b8844260bbc624e20763e872d80451aeb9bd24

SHA512
60640d2a1a97e8c1ee8e845b668e4d85fc5bb48fd6e3df179464793c9bedf133f5d8b26c89e3d8898f45bc4b13466e553688e9a142f4aa11bed4f72b85c0e77f

Download Submit
memory/4404-247-0x00007FF719690000-0x00007FF7196AF000-memory.dmp

Filesize
124KB

Download