hxxps://drive[.]google[.]com/file/d/1kpmxDbX-6arJEzBas8chpPgX27H8SZzl/view

Analysis

max time kernel
50s
max time network
58s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09-11-2024 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1kpmxDbX-6arJEzBas8chpPgX27H8SZzl/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
7	drive.google.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\fbf76007-9fda-4eda-98c4-288575157c53.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241109153333.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
3776	msedge.exe
3776	msedge.exe
2352	identity_helper.exe
2352	identity_helper.exe
5440	msedge.exe
5440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 1220	3776	msedge.exe	81
PID 3776 wrote to memory of 1220	3776	msedge.exe	81
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 4280	3776	msedge.exe	82
PID 3776 wrote to memory of 1608	3776	msedge.exe	83
PID 3776 wrote to memory of 1608	3776	msedge.exe	83
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84
PID 3776 wrote to memory of 1960	3776	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1kpmxDbX-6arJEzBas8chpPgX27H8SZzl/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff99b0446f8,0x7ff99b044708,0x7ff99b044718
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff678a55460,0x7ff678a55470,0x7ff678a55480
    3⤵
    PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,9761502969338565342,1578062884978077126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2905b2a304443857a2afa4fc0b12fa24

SHA1
6266f131d70f5555e996420f20fa99c425074ec3

SHA256
5298bdb27d48c2c2b5e67bdd435445ef5b06d9b36c11394705b413ff3d0f51f3

SHA512
df85de0c817350d8ca3346def1db8653aaee51705822b4c4484c97e7d31282a2936fa516d68c298dcbbb293b044aa7101b3de0c7852c26e98ac6c91415162b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5391bd7b113cd90892553d8e903382f

SHA1
2a164e328c5ce2fc41f3225c65ec7e88c8be68a5

SHA256
fd9710650fc6774ce452b01fb37799cd64d3cdc282ac693e918e38322349fe79

SHA512
41957bea3e09c2f69487592df334edc6e3e6de3ab71beb64d9b6d9ce015e02a801b4215344d5d99765abe8ab2396394ac4664fced9f871204453a79463cc7825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
c71c133a0846346a6914f72651a18179

SHA1
699ecd9af1fc9590d352d4ccfc2b22f30700f66b

SHA256
289702ab9210bc7b4d493b0cef8579f78e218ef89fbdcb54c712938cae3c1048

SHA512
a85769d1b5ab8bbc602873e09f232789b8f810b535115795398700db8c5cab6a3940b6691a11684504ebdaa7b96ba6526f08bafa075d87e7df83da218b4cf208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
30251693ddd0aaf395ef6a23ca0e2faf

SHA1
460e5a24b8d870463a58d5730629296eef333830

SHA256
0f6c7e3a46e9509555cab8de40470b3200793d908c1fcee8df17782711f8d991

SHA512
caeb9acaadd4f2790cdbf739a1e8b27bf1b9b14faa9013e4a2914b508378a52b95fbb7429679e6cb31ec1265c4cdbf10bf5afdf9a0eae676d6690750b900a796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2029b7b7440ee08749ebe60b55fc3a33

SHA1
806c6a7865621d889a87a932943b5b6853666cea

SHA256
32f9f07b9f84480a758dfdd150f47cbea728eeeb12b427abed913ae4bedf3dd5

SHA512
e017171198e0a60525c72c9424608cb57ffcfbc316f057ef0e25c9f59b5e5c725d88ef956163fbf72cee13ff907e82f9d7710e0dade0942c6fc074cf0867f35f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51cf16d3c4e4e85ba8ec80b34e94620a

SHA1
6f81f793c3eb0966fec26fe4d7b896d6292ba2cf

SHA256
8b63d332d6606a2b91f31a5bcc82e7f54d144a8a1bbb02534da942be84a9e220

SHA512
34ea455bea3b51841a7644d42756e4394e1e05fb1061392f3cc74c5553758334faf2cc24153757e3a2d592ff67290a05c89c6515256e927b0c7317f19709781d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce1a855d3f9277285d6c60e717d10ff7

SHA1
5570d5ab16e4e2ebd6bb2e4af7a9d7561b2c16c6

SHA256
fe2061895cd0855759557040c39faf10a1b76fd22dba4c43728680ca8510324b

SHA512
15b10ba4bccd8210a90e59750a591fa07e9ab667ba1f2903a6442db6df2c8975d991e8b4d7abe499b5d62556999045df3ed889717da6054654e4e721f8965870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ad9709100fb43b77314ee7765b27828

SHA1
5cd0c406c08c9c1073b0c08169ccaffbd4ef6b98

SHA256
04b61824ffce6fdbae4e6a527ae58b85813226ee28fe4d631feb76b5f936a1a9

SHA512
fc55ee34b1107e298f2cfcb20dce42b5dbc98a7b68e72ed80a6ea594f66dff6f9e9cb70ad5ccbf5ad2171275f375abac1defd8dad4118afa280cd9c1d9f6a538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e122fc93c0ad25d45d09ba51a3e86421

SHA1
bb52a7be91075de9d85f4a4d7baeecc3167c871b

SHA256
a277c1c6fafd7a44b47d94e4bc3c0337a64a34d252e58722855aab09e6f52bee

SHA512
12787aebefd6a5e4584ec8747a78538f948a16b214bdf81302036ae89e2c4563027847236a4770c4f780a9ca0ed03f29b1577bfb6f11feffad85b7a625324bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
ada112a87cd55b7464c363381d056eac

SHA1
3774844fedf16a09c38c19c4701639a8bae135e2

SHA256
11b0629bb17c5945220e24c866e73edb24b3d29428e209d0b00c2f348ed7d07d

SHA512
f16a0d6fa15c8152f04ce594ad842846494032a1093ce95c75494a5ab9fc2e43f1bfc9ea1aab257aa126c2d8a727d6e4e8f1ed3143c1e26aeae614b3842ecdbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
82bbe28a27c83b5fd0aa1e3a4fba0b2d

SHA1
eb7436d9942c8e73dd52e2a88a691459ad0da0b3

SHA256
138c9ca45c2b755fc608358177b505262b871594967112c48dc1d1a3f1a366c2

SHA512
fc8703097eb249860160fe6fba1f5ec990ae472a7ec743a92355bdfef179a3b6b07ab0ae11c7aaed7f6981fafd01593ad40e25e138a11daad80feb3c454eb925

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e7c22c2401160bff5cdd24f31716c320

SHA1
a8a941b63608f25af50b7a17600ef701fecaca8d

SHA256
2f4ed44df7a1b8548d2be6ef58821512bf3025885ff7b73e03f17ed089e58a42

SHA512
e13e098e4ef2581e052cdb05fc4795bf90c2a4e819845c95ee69389c29736f6d663f1ca8030c51f06b53884ea89042388b6b6da256b2a3b2d8c7897a96026de1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
dda26659647878ae2170956ebe77cecb

SHA1
28d883a4357ffd647ab6b3b0ba7e6fbdd0849a6f

SHA256
e0f311dfe564ef6347810dc7430f5318fdae0e6b619daf129c92dbce4b8e7d37

SHA512
c321acf1e61db98322cf3c554aed4d04b532b374e9b5ffc6ac69c6b0b424b19ef5b85da3c951921dc4374762fe7c12db2a0e065ce170802b00591886ddbb6df9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 772132.crdownload

Filesize
1.0MB

MD5
561ed8dff6ae6aa21758b8c23a62799c

SHA1
4b724289008f9a2b1831386b0dd2e7db6a7a99a4

SHA256
59a0339cfcf39da62d92b6cdb927f4f8bab0fa8dd9d63b6b0191a759e025f433

SHA512
732515a60ed0ced86d187fcc1f64e2345c46ee539f991648f702dd5ec4bdbafaa676fa20a15e8eafa4352d90fce2bdaf69860fcb4fbe67898d7debc725b2ddcc

Download Submit