hxxp://drive[.]google[.]com/file/d/15VWDXEB7iItjCcbXdLCG6-1rKBiTrDjo/view

Analysis

max time kernel
299s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://drive.google.com/file/d/15VWDXEB7iItjCcbXdLCG6-1rKBiTrDjo/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
16	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
1308	msedge.exe
1308	msedge.exe
3484	identity_helper.exe
3484	identity_helper.exe
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 428	1308	msedge.exe	83
PID 1308 wrote to memory of 428	1308	msedge.exe	83
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 1896	1308	msedge.exe	84
PID 1308 wrote to memory of 4780	1308	msedge.exe	85
PID 1308 wrote to memory of 4780	1308	msedge.exe	85
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86
PID 1308 wrote to memory of 3600	1308	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://drive.google.com/file/d/15VWDXEB7iItjCcbXdLCG6-1rKBiTrDjo/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff094d46f8,0x7fff094d4708,0x7fff094d4718
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4387995726280667925,3333905170310032258,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
401b9168e4f1bf03c4174ab683772564

SHA1
49bcc52af72220216516a38aa94951ac8d6c7d78

SHA256
2b52e4957cc742882b15062c8f8a94a94fa8ef4251c4ac48d5db49803f44c1c7

SHA512
f5f60bff3e54bab9266c64c8156ac47e1f42ba1e405f67235cd7e0341fe8813e2975731ef0c2db3094b84dc0fe93486a50418bafc706151ab4c52e5bc1b607bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dbcd0d2ea30d1542b161f1bcba9e2d3f

SHA1
12ecbbfaca9fed8665492bffb8dfda288c35e26a

SHA256
9820eab2021a82e4db35dc01451aa33b7b22b0a19cf737fe18a6735ad2c9e790

SHA512
7dab8dfca1307d00ab3020fba85eb77ac0a4dd1c3216f1c6a5ee50eaf72bfa0afd4f95217701283ee1644745745446e4c61317a3496396fbd2f2f9c1a6abd4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
481efb522e4bf6d260ac3558e289f4a2

SHA1
2839f5fdadea6ebb5ec94762e7ec7d9b16d7c645

SHA256
84989381426dd0753e5bc1c51c1f4ef13c0f00a18e3dff3b9ccaa73b0e0489ff

SHA512
3791a8608419e82f51809c8ca195a9a8a38437d22261b85787f3c7d1ef9660378120821f8433aec8f0404cbadaf564847fcfd1defcd25ce70850c0feb89fec65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d5648fa094d89e553a0794aec8aa6d73

SHA1
62d09299a997ac4fe57dcc382be5df9b891aebf9

SHA256
75ee8d8bdaa8ae6979a67dcd3d56d91b19bc54450e676250f7ff3fbc53d474a6

SHA512
411c69d335bb50700f365aff919bf2aa25abfe66142fefe2903f6d821ef1333c804b20ff5b2276f65b6d44cff7d0f696594406ec190914e10c1d5f168f979bdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
86c8ff94f8486de7f70cd434bbd69c90

SHA1
93e93e586f7204e504184fb36652368eaadb913f

SHA256
bd3a907d4b3257c00e783853d78669dace0285235343255bac12433ebc79eb4f

SHA512
19c8301005aef5155922647d5b747f668f28f203883f63247c737ccc874b6fd2286ca6c664f8026101e7e284c248850234a56cef7e04687229663a467c8b8341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
326c534ee4e45beba6f2640724f895cc

SHA1
ae9bf7c4eef0c162e14f806410f87547947d3319

SHA256
37349c035fa05a949f6718da13e91868c13d6461f0f8f60ba3335ed8b28ca97f

SHA512
090d8078338a1677c0ccb90a90c4caa496a31dac0ed1ddb14b704e70c44ebfe05dad7c5c0d05acbbcbd9af30fbea9de037e73a11823b60d1c766b8ad0cae358d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00d53ef488262265d6aeb9bb8a1fd3ae

SHA1
5b99053d6f379647833e5884c014cf828cd52ce7

SHA256
a9e7fcc8d26dd04c859bb2b1696f2953829d174fc37682c45e561066900c0023

SHA512
92d1389650350b7359aa50c2a1ded755934af6bc3f861422cb4fe56c60d407ea2244429cd9a0772d77b1b6b7984d71c38520d973d0504e1ca94b6bc7c9c34376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
716cd4e5784d3bb681607e4160364ec2

SHA1
b06e620671bd900a359e8f38a99749f90aa19add

SHA256
cf78e1483b2b882014491fe54ddb6e75735ab130ae947d3e6c2de0dc97cbf9ba

SHA512
d12ebe4ba99c1f09a9b6015c804fd21f75db4f0e5647341bc375384bb72b8e9731a44f1ccd44995a1d35777e3251b2fff3c1cc85e1f8555780ad57f0c5e01024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
1569fdb17976db2ec2b0c9c348842985

SHA1
9e1c405936cb0180534d9d3119c5d0c77ce19649

SHA256
52bb810652a041e8e3df7755dc33a0b0f5a6d5c11abd0202f9ba140a5a0056c2

SHA512
3eb077910c45603ec79870962f8dd5710b0008537a0d1d0cdeab0337650c7230fd2ce6a1ded4e06170389b10e82f5b1d6ff20d39328383d6107b061b0241ee22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7fcfd169f84f6986dcba34e3df490409

SHA1
9e6e0aa8399d407c8139e1e2bd7d948541b38a9b

SHA256
875f3ed66d4af66ccc57640e1d3e51c8246369a48762a6c2d5fe57ac555f1219

SHA512
622f67099d8c70a4201c1d063cc2c8993606ee1969cf80ce0db0bb59696f9a97c6c0faae8ff35411b81d5cf55f077369a106378fa52dde0a2ca8c20059335451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58124b.TMP

Filesize
1KB

MD5
b4417fcae3b41bf7f7d335fbb404344d

SHA1
ab2af33725077a505c50a896a573675795de9fef

SHA256
3ce6a4b5495f7b4e435101533334adb75a05d9f6f6b8a52613c218849a1cd61f

SHA512
e99f15187dbaa365a876b26c84db94e0bb96c81df6072a8a3065f6f159ae1f458bd2844a4c9712224a6457cf0f0364321c720eaf0b3bf8d2e53b6c6191505be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
82475988736dbadf549b90ae2a3543fe

SHA1
7ffcea0601d88109d62de77ce5e538256bf1c32d

SHA256
1d8fe8ee9da15027b4dddb690947bf4371f4f7ca6dc89d071aa6081b6bea9fbc

SHA512
22077b99b426225f0e176628a30577f28c7104401c7376ca06e2439daa7cc18fc8803a098d0b2fc4dbdc3717b94c3bdbaca486cf9612b98cbb402eb1a9454a36

Download Submit