hxxps://drive[.]google[.]com/file/d/1XzNLj4hOW9wph4K40ujmEFIVdYk9uDJ4/view

Analysis

max time kernel
133s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-es
resource tags

arch:x64arch:x86image:win10v2004-20241007-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
19-11-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1XzNLj4hOW9wph4K40ujmEFIVdYk9uDJ4/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
3588	msedge.exe
3588	msedge.exe
1952	identity_helper.exe
1952	identity_helper.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 3084	3588	msedge.exe	83
PID 3588 wrote to memory of 3084	3588	msedge.exe	83
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 1292	3588	msedge.exe	84
PID 3588 wrote to memory of 452	3588	msedge.exe	85
PID 3588 wrote to memory of 452	3588	msedge.exe	85
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86
PID 3588 wrote to memory of 1820	3588	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1XzNLj4hOW9wph4K40ujmEFIVdYk9uDJ4/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffb02e646f8,0x7ffb02e64708,0x7ffb02e64718
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,16681944956775830227,10070826506243759352,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x438
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8d34f8f810818be2b61034ffc262d0fe

SHA1
60c68b251a4b2c15e8cede7c742da110b3843be5

SHA256
b2e1e9f61a6de5fcc68694e5df0b6dc3b9495edb0d364dcee37079792250070c

SHA512
8af950348c35163d695bc531e701b6ab1481dfe21700c2cb7ba4f92ce6fc4a07bff2651646d4c8941ad4dd90568e42ecdd039c41fbe9e32c9fdc7cdabc6d8358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
db6aa77ee3f90cb7120ddce517aae1ae

SHA1
bc48924e589eefc4575740c05d4ebe6db9aee5a6

SHA256
6ed9436d4984282986fbb721a0ae4dee9e37c1fad54aa19fb339b2bb4ec494cf

SHA512
9b3fe2e2e8ce0d54ea9a8e9231c8796797657fd798ce4ec6e54035d96e37b9a78bcdac9dfdc9637aec1b77349dc9515d6c0665db8f04418c463053e1970041a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bc7e16f4c5764e434b1212ca191952f4

SHA1
79da51c8e72c6d980df6953a775f517b930c90da

SHA256
17730d3e967ea7ff5be704cb5a0e03ab9c215c69b48c89f9bdc80e494635f442

SHA512
023d813e4c379652e3ef951b2fb7e74e104401c260f8261ca9930db3923e75f315d76f597f26d5c56efe44cd2a2039bf665f2c99164eb2a44eb07e7dc486521c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27be6d277a51c576281c292eeaec7f13

SHA1
9b86eae6e666196f928c60d5aa422e9e4a31abce

SHA256
8e867fdd42e13fe3dd90083173efc2ae21b1b77e917795bafc5324bb86f74346

SHA512
304e04893a1638c314493d8ad080be6533152e51f624ee5c63ed7643c1917b4294b212d331d35ed168e680d7591120afe7aca5c6fadae21a4165e4498ab9d545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a10b9b962e07035df231f44fde4f34a6

SHA1
b33afae0a3d5d69538098c2974e20161732d1d13

SHA256
95ea3a90577fa058e82792a526122864a34c97562ccfbb1e3d91d269678ab3b4

SHA512
837a46d018608f83b69488fd636d2296d9053a79ff93032b37cc2b00e96ba6d25b3372e70b50c9af387c98b23adb8a073dc562e0b36e04518aecea8f6ed4ec7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f31b06c3b466217d58909881fd16a1c

SHA1
22dfd6bc9d053555d8e604a18814b86739388eb1

SHA256
4a39dd2e0bd3ed0a2b135f766d757ebf28c75f544cd25426cb5dcefd7c371a5b

SHA512
00ea3ee813e3aca74ba2df6df2d759e6f94aca46f0746c49c33deb1f6fbdb999d9c5960b26937c34c6828bb336275594d89905441b4f4ce76168389ea5ca501b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d19b0452caa0750b39430f06cf3bbe40

SHA1
c2d8ad9950abffe147dba98b8bcf00fb6e750df5

SHA256
196773a76ad2ea2383526eb2c43c73a059b43071de8b1a296bd0d99c12478cb0

SHA512
d1ee56bd0156d8cba39370aaf2bb5abe024bb25c48c3f0ee65ef0b5a08441265d381b5767a0bb6bc0d15268c34eab8dfc152e4fa27498d6815517e3728caaa62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b9abd34bf5ad44eaf5a2174e49640409

SHA1
37d128a5255e100f383df3091cb67eff8b8a440e

SHA256
925209073bdbf1ccd7e95346648cfdcfd9d87a76f799d8d363dfd8273bc96e17

SHA512
f5dc2aba92ca6857d11783ae38c3aacbb029a871fe4f87e6d2c48b9681e72b80e987b70d1f5ef3f26bd2ba7b8546973ebf3a90dd784efd243835c8085bcf1407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ab306ed53deba7edbffd60468b13f09c

SHA1
a4eac8d848f606d2e9e3708664fdd717bce802d2

SHA256
6fe8e0b0ab595c8fdbee3520da0c65f20724d10f238daf69b06d15f6401b46d4

SHA512
828556f71ae784a40e22f432566a989e7ac53bc047aa8f30c9538499d803183a216a1a45876c3286aa40637231d1d93eead2e8e566ad833438814d04bad62c35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1bd450081d8addc44fdec999b8d41fff

SHA1
7df475ae7aedb066c82f45d0a1af4a9c17abae88

SHA256
8825aa9cc290756e3c9e07ecd6987ebb6f38e448ae62b0edca7998e5056115a3

SHA512
c1d578f8e99ddcda48338d2b883c53637607da009a3e93e8b94186d3f968d1f1b0b6eff31acd76dd05da89b20a4f5441908877268e86a2db0b7f199bbcf4adf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c835e12182d9ba5b75de3dcfc6ee86e7

SHA1
4bcb99ae0d7cc4fc70156056345122bafb10e994

SHA256
a68018e2cdf34a4fa122c57e3bdb82e81987e60813a11895d84561add60e842a

SHA512
8ca1ac4956a09d4d73c7a1b72b5adc3fd266f85a6da631b7af55acb20de80a9b4b1a2c79654f7d7d294c5350bfb9268662f29ed7c3d78d55cb438b273c7ba2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a1919a9f9cd0a71ce2cc84f9f4193128

SHA1
25dbcaaf867032c810ee66c95121ae75d1bc450a

SHA256
978d35eff66495002a004b845aed38a072fcda00574d248f22a2823221eb52bf

SHA512
26811021788092dae2d14bb4d2c35f58de0f46feb3a82dcab6304d70227318273658778fa06cb1356f4c0f545d11b587d88411488f0fe8484249b5ac70512345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f8a8.TMP

Filesize
873B

MD5
0cfbeee977149eb2ff8a8f4d75c80e99

SHA1
d9c493c04f78239e24e9bfdb7be85f3c17d78ce1

SHA256
f1104359237f84dbf50bc077866992eff907f28777ea7e6f27988c207c47d8c3

SHA512
a7d3bc72683ba3a67e12df2dd8a7af29c984333efa94d4de2e604b1410c7f2fe4e280e84e9e7e8e0edc54c6ae878afc21603083433ad71b7955f9984cb5f7173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9600612ec47a0a0818b4642354bb7b9e

SHA1
f806881427834ad2e81fe5026b096b290c7c6b22

SHA256
7f168d8880f426de42d02aa46355bc8bbac423a6982ecf2e92b2db3dc6c42581

SHA512
f92145dded8e091d6da042af5f7de3634f7291fa0582e8edc9297d1a297c6e9d5e2110f876f2c6936a0166b8a22d5b4f77e82b2924b1025bfc40df3c67f9669b

Download Submit