hxxps://drive[.]google[.]com/drive/folders/1suPAPbLl0zolZ2WHBDdcPPI60-KYH7eH?usp=sharing

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
26-09-2024 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1suPAPbLl0zolZ2WHBDdcPPI60-KYH7eH?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 880071.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
1756	msedge.exe
1756	msedge.exe
3076	msedge.exe
3076	msedge.exe
2872	identity_helper.exe
2872	identity_helper.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 3980	1756	msedge.exe	78
PID 1756 wrote to memory of 3980	1756	msedge.exe	78
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 2996	1756	msedge.exe	79
PID 1756 wrote to memory of 4208	1756	msedge.exe	80
PID 1756 wrote to memory of 4208	1756	msedge.exe	80
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81
PID 1756 wrote to memory of 4184	1756	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1suPAPbLl0zolZ2WHBDdcPPI60-KYH7eH?usp=sharing
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe57c13cb8,0x7ffe57c13cc8,0x7ffe57c13cd8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,7307443382669469550,13888052587493585529,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b23bba4-4bc9-4c3c-94db-df644a093843.tmp

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
28KB

MD5
78fbaa6c69ccc961b8ec438a8588001b

SHA1
990c7f85fd6739a39ceb934cacbddd8ca7672627

SHA256
708cc85c1b714f37d78a73e237276b2525f644e3e5ab935d7671368f21c2d4d9

SHA512
c9b167bc97e6a65745576831721bc21c1ebb4ea9545643f2af6e7b4879b5930db85991013a12a8debf645f3b152b9c27afa619c245e21d35d9cd66b1347a0aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
47e4f9d2cb1e8567af86b5492536fc48

SHA1
238c10cb6ca5ccfe589e265e9a84470c474dae00

SHA256
6a65810df2eae19d74cf25702c08ad81001d3eddad1b6066eb92e007606b1439

SHA512
ad4c8fa9e399237b01bea5ac87f4096986211c46790a15fb51955e8b285d86d9957d6c8cf20c1be6befd3c2a272e12a0882732734c3db13a79db8a5e41fc8ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e93374f506643e8a55f7fc683fa976e5

SHA1
46963a29353bc329200cd20cbcf0bebb7a1a8368

SHA256
e3568b97da35e4d034a6337a62b1bb9aee45f0312477d21237d236e34d29ce95

SHA512
5931e300656f1bb1540c631b9c978eb4bef2a22a335474a02799b7d77d728e6cfe251d301260a06d6e04a2cab887c6f3404549d576f59938b4676d955d2dc046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
04f2e8e389188bf014dca66c000a58fa

SHA1
f322a820a23c49a5cf0a075ffaffcfa03400806a

SHA256
ab53ed69d7df4f662344a1933e55b89d36c3fa8c214f8d00a0c189b80fb8d54c

SHA512
1c6d117acc3d294f9031fc37e792ab64ddc0f1e2b75cce4993e96349419507fb30aac607aa8d7b341df439efbebfbd57e5ed572409610a84ea3b252827c44ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
60518058263517291c247307f7d566eb

SHA1
3ef883675ff391777d846a4825b64a9d8686d7af

SHA256
167ad73c44cd2e48a1230c3d0ff7479caf6cbe8adf87305cd91c4d82d9b2e936

SHA512
87242a9f2b469114c5d6ef511d31e15c50cd9720d360919c7e60c638449854a2443d59b85c8508d8e3503d368ca97256e9ececdcd2bbd712d9581ad4ea785ce5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93cd26bac35759fade0a48661a5abfc8

SHA1
ec8e8d083956bbcd45a09a7c9aa4296453a499dc

SHA256
8f1a92b75f571c0bc08658ee33796991d6bf0245108869b21b3bf11310f84711

SHA512
6065ac3210288686fa3cb005f5be45174c6e5dbc1c47f57ba5e1111733041cadeff0c921ea2e6cd4b8fbadb2d9acebf1bbeaabee01794457708c22aa3c7ac401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e6332c31736921b816d508ef7b51696

SHA1
69684698d0cfb5a2c3ad1dc3332c997390f6832c

SHA256
9c21f30a98db102716e258bcccc18d796e5aef0677e02cb6a558c923fcb335e9

SHA512
b26272cd1d98411d6058863ebe541533d98fda896a77bcd6970743bfba50d2ed258637709b288e2a253f70c9bfd47ca93b2c42b74eda0b86f78f3977124d0b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
393f47217cdbed16ed682301961dadaf

SHA1
a0335c966bab1263ee0179f741a90a554bc311eb

SHA256
c98d765865df7ba2eaa196b8a17ac929d71cd541f923b5188d871819f4125b83

SHA512
968255322aa5227bcb98d239e2a555e713e41a54efd54deb4a29cecb0f565d3c995ed5b82b2421bd594c8fdb687c42d17e7680bf11b91c224fb1828e0e9c8d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5504aef1156254e359b4d8525c3b2938

SHA1
551a7328ebd3181728048890bb66d5fe42a362ed

SHA256
98a088a2b8aaf73cf5f9e62dfb66e61157922310870cd9c81fafe81561eba7f0

SHA512
a709f4ef40e96dc344e5075d3190c5ae0ae9802c56378c4169e6897796110494406e5b96929645981794144553721b3f3edadd65edafe4459df9311e5a71d9b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3da9c2b80223556146e1007b4cafcc69

SHA1
23f5855e8e5a15807c6bf65372ac593253d3f581

SHA256
e3e0b401be3ade4fadedc599ec9919e77dffc44122fb30764c882b01915bdc42

SHA512
7125c319bd41b309dc0966c665bc0d768a28d8711061c43de827b9f284a6ddba140e5547d0a1a979dc04a7a1deebf252d5c062bb33c53c24d08be972acead910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b1315b8446782542e22184fd32e0bbfa

SHA1
704e299918fe2396d59b2dd384cec314cbb2040c

SHA256
283cd6e59e315a3a579e1371f7c53aa4a5bba1b24cc1061efe3978c483bc85d0

SHA512
39f30fa19c17d1c081ddd52d0778f1c0d10c1981546c65e9123b32813d9d7dfb43ba5764a60616518f285b95fbcda3b609b380b46835d8f3db40cc6104f5f922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0027332da1c645fc8f9b0066c5b0b590

SHA1
3ebc55a215bf5a82c120056fda6b1a65361c07ef

SHA256
9879f2e544f36aad47705867787a9a496b539e1025faa739c19e2bdf73cf2a6e

SHA512
6b47f5050d32373c91bacd596a32499817b552d63efd48616bdaf5219ba43ae53ed7e37cf84252c2cc58df131702fb490e0ef2a8e24a03cc1513da60c0c33872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6b9513eb2eb1081f1346f6ac91d55fec

SHA1
ca7efd024eea01c93b460d57983ab5a3f0da57df

SHA256
becc10e1a6f2d4aa4f9d91a6e5cb633a530015400c476dba8842877addfa83dc

SHA512
e0b026e46fc27190b9a64bad946f28ebe7f235550e0a619bed66ceb90584a6376d844569fd168932da47b4d6bb98fa31cc0667aac5109094a8e61dc2ce93cb8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f7ae.TMP

Filesize
1KB

MD5
93d30b66ddc5a657e65ad30b30e0c4d3

SHA1
87a9139fffc3d922f3b935233588d0fe804126c7

SHA256
622dfe6510c3bde707898609f59eb740890be93e94d7d1526e8497b15a500c2d

SHA512
c83b175ff44667ad8d35953315034793a781e4f4685e1cd146a04bd6cae50b4a438318c8c292304f1484ad77d317b35b9eed1c8bfb4218f3bcd94210be7f6627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
247e4e86c4b30ce83c32594cd7dec25e

SHA1
b5840af77db088c1d326ce904e28229b602ea2f5

SHA256
f703814852d40be7377b3ec89781d221f285b225a89614242c9695190628313c

SHA512
b1fab0307e65b58a47002a43dc9177d2cfb2d41e1681e14d6b8933e419e11128d8d51aa13ad38ecde657b81bec9f62cec85b00b903c784a24cbe8e5a496d29bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3620d60a935cb0019822078885ad739d

SHA1
444c504abdf6e01f09588e13ec1b2435a11a6808

SHA256
92e92719f91fd06e715dda66b5b2d079ac1fc3ec7eb15086ed02473f843b68e0

SHA512
13eebd71967879325d9c68f5c9b809f3c4b16d4402092c4295e6155af650a7f94e47d18f928a4da9a33934e7f08334aa80c221412433e56f28d0a57c6f567592

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 880071.crdownload

Filesize
858B

MD5
e337bbb09c67712834b6be91ccd23575

SHA1
bf68e565709cf0a78aac14e7e19b95b5452bc70c

SHA256
622d27a67dc5b7f6183f27f8c208f08ea0dcc72080738fab171745a451114d0e

SHA512
77327ebac1f2a3cebf08e8135bdba7c6dbdf6c61bc82169f356c044aff3bc2c868f839c69bd28b6973d3a07144f250ed084fa55159e2ebd60b06cac56829dd34

Download Submit