hxxps://drive[.]google[.]com/file/d/1uUt2Y2pv2GTPR4QPP6x08DSZKmzde06S/view

Analysis

max time kernel
102s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1uUt2Y2pv2GTPR4QPP6x08DSZKmzde06S/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4116	vlc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
3060	msedge.exe
3060	msedge.exe
4776	identity_helper.exe
4776	identity_helper.exe
5784	msedge.exe
5784	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4116	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	3620	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3620	AUDIODG.EXE
Token: 33	4116	vlc.exe
Token: SeIncBasePriorityPrivilege	4116	vlc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
4116	vlc.exe
4116	vlc.exe
4116	vlc.exe
4116	vlc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4116	vlc.exe
4116	vlc.exe
4116	vlc.exe
4116	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 4144	3060	msedge.exe	85
PID 3060 wrote to memory of 4144	3060	msedge.exe	85
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 3640	3060	msedge.exe	86
PID 3060 wrote to memory of 2916	3060	msedge.exe	87
PID 3060 wrote to memory of 2916	3060	msedge.exe	87
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88
PID 3060 wrote to memory of 2096	3060	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1uUt2Y2pv2GTPR4QPP6x08DSZKmzde06S/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe56146f8,0x7fffe5614708,0x7fffe5614718
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871765747338420481,2713691520113297029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:5900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3116

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\Planned Releases\Planned Releases\aw dang it\aw-dang-it (1).mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
3bac968025474f019956203cc5e0d7e7

SHA1
6990ac19b56dc041304b7cd9c8aca734e86a117f

SHA256
e0ffbfdd64393dcd33c174f5e7d9b3c58eeafe7ee1b7bf8766af8c7cc1bdddb6

SHA512
ddf8b633ce48355c5ce63b15f120efc3e331b5572133ba6ab82ee15ec3671b2bcd6b384955a5e62528ae3be3f0a68353cc67253121fb29f32402ff32e125ef8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4675d4602f1c2f32ac7bd013b9ca1e9e

SHA1
74497c102b0428d5779d266e4c384f1ab1b289fa

SHA256
2bd4a5b0b58ad8f22ecfb6b29ed255c9142125e3ed1f7ca47b2183f04509846f

SHA512
ed88314e27e0474250ca8682b95c8df5dff45ee7443d364281220a03cf60462d6223a9ddf5979c46ebadc256499b99fced12b3cd072ec7c7bbac5b03951df3f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12f41f111b7e3dd8ab2203a8ba84fb7a

SHA1
e91ba7e091303a6fb6cb885d5feb12149251d465

SHA256
57cc1142c412a8404cb90e944c41de069e9408dad6cf2bf0e02022615aa0af30

SHA512
c05e771df00998b9dbfb4e9930e023570feb759439abc8671afaeaad8c02c60e9d6e7a7758dbfea4f4a406c701c65ff0f924b134291d28076c230ad1994a658f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0628ad6d750f59c44eba39c751090d30

SHA1
fa1fc539b07185508ebaf216c8ab7676b3e23a05

SHA256
42e880d86e7e003dd88b3d89d6d38513476ee3f109159c20c6111a1399493e83

SHA512
1033914dc98e76ba9ac2576fa93cf534b46a126c40e1d64f151d2c07bb6df888457a74ec7e97afada4b201d7415390bb55720db7534005bfa6004f092b9b962c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
302529cb4a2e9ab341d34e060c5ab4f7

SHA1
0746a81953d2a63e5517e92b9426b6093aa697c5

SHA256
777bec6a5040a939d04003fe177a8e2f557c85f168fa932196a2fdd7757ad70a

SHA512
ea351981c6e1d2a750797aa4cb56f865333a5742c0b5b2c3d86158d3283be374827effaba2782ae26d73eab8d8fc9c77fc2580f721d32f22d2d31783fa87cc69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3cb71ebe2c477d617318e73a5ab5ec4a

SHA1
27bdd51f0e163429ec30879d6bcd1cd35e7fd59a

SHA256
d62aaa432b30404576558a9718da65432c835d1adba741499b8e890e7d97aa37

SHA512
4afe501dfcaccdc98ea0d35f4d6fdb26e2b12356886aea667767e7b99be05d9496359310e9aee833f1f34c1011750715e0ff1c0dae135b16cb34577a9b31eb94

Download Submit
memory/4116-213-0x00007FFFE1DD0000-0x00007FFFE1DED000-memory.dmp

Filesize
116KB

Download
memory/4116-209-0x00007FFFE5ED0000-0x00007FFFE5EE7000-memory.dmp

Filesize
92KB

Download
memory/4116-212-0x00007FFFE1EA0000-0x00007FFFE1EB1000-memory.dmp

Filesize
68KB

Download
memory/4116-214-0x00007FFFE1DB0000-0x00007FFFE1DC1000-memory.dmp

Filesize
68KB

Download
memory/4116-206-0x00007FFFE4D60000-0x00007FFFE4D94000-memory.dmp

Filesize
208KB

Download
memory/4116-215-0x00007FFFD0FF0000-0x00007FFFD11FB000-memory.dmp

Filesize
2.0MB

Download
memory/4116-207-0x00007FFFD1580000-0x00007FFFD1836000-memory.dmp

Filesize
2.7MB

Download
memory/4116-211-0x00007FFFE5D00000-0x00007FFFE5D17000-memory.dmp

Filesize
92KB

Download
memory/4116-210-0x00007FFFE5E00000-0x00007FFFE5E11000-memory.dmp

Filesize
68KB

Download
memory/4116-205-0x00007FF72C650000-0x00007FF72C748000-memory.dmp

Filesize
992KB

Download
memory/4116-208-0x00007FFFE6100000-0x00007FFFE6118000-memory.dmp

Filesize
96KB

Download
memory/4116-222-0x00007FFFD5190000-0x00007FFFD51A1000-memory.dmp

Filesize
68KB

Download
memory/4116-221-0x00007FFFD51B0000-0x00007FFFD51C1000-memory.dmp

Filesize
68KB

Download
memory/4116-220-0x00007FFFD5300000-0x00007FFFD5311000-memory.dmp

Filesize
68KB

Download
memory/4116-219-0x00007FFFD7620000-0x00007FFFD7638000-memory.dmp

Filesize
96KB

Download
memory/4116-218-0x00007FFFD7210000-0x00007FFFD7231000-memory.dmp

Filesize
132KB

Download
memory/4116-217-0x00007FFFD5320000-0x00007FFFD5361000-memory.dmp

Filesize
260KB

Download
memory/4116-216-0x00007FFFCB2D0000-0x00007FFFCC380000-memory.dmp

Filesize
16.7MB

Download