hxxps://drive[.]google[.]com/drive/u/1/folders/1iDmne6wCvkviZu8V8PUITjl3nzRb3sWe

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/u/1/folders/1iDmne6wCvkviZu8V8PUITjl3nzRb3sWe

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
9	drive.google.com
13	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
1188	msedge.exe
1188	msedge.exe
3960	identity_helper.exe
3960	identity_helper.exe
4036	msedge.exe
4036	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe
1188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 392	1188	msedge.exe	83
PID 1188 wrote to memory of 392	1188	msedge.exe	83
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 2004	1188	msedge.exe	84
PID 1188 wrote to memory of 5076	1188	msedge.exe	85
PID 1188 wrote to memory of 5076	1188	msedge.exe	85
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86
PID 1188 wrote to memory of 2420	1188	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/u/1/folders/1iDmne6wCvkviZu8V8PUITjl3nzRb3sWe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc69e246f8,0x7ffc69e24708,0x7ffc69e24718
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2444 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8671252903962783493,1956730741234746570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
25KB

MD5
ab77c85aab42e61d0557bfe285bcafc0

SHA1
ac4241859bef658513fee5ae997b08543b8029e8

SHA256
32a74d447d992c99982a6c6979935c3eeffc358bcbcf7b1843ccb8021523f398

SHA512
41aaeb6c514f1ec1e97e213739ee2f4cd731cfa17fc1bd2c0c2d6197eaa487ed4b57c8d359ddaabc8764db4e12d3000eb2e23f884aa5dad0962ee9e0ae1d02b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1c5fb96e22a16f07cacc460d2eda45a6

SHA1
4fa2d0d5e518f6bcbf99b814b2aef8ffa7d74e1b

SHA256
92ebbc7ef7ccc8b5c4160ed81d70dfea79702fa6bfb37daf27cdd52cdd612b10

SHA512
d984e340607e2ca7947d133d4557f244640e7fc34b2da40c355ef9ba65bf879a65867d252a2f81b92c5e2ed3508c112f54f860d5a8bf2ce1500d5720a687ec18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
101cc4db5d8dc233991a0081d43a61d4

SHA1
e0c6816f9a63f8c6381d01d5bfc4387045225266

SHA256
6be1d448e47a03edfdb4d610a1413d4edb7093cb9a6254ea85bc4325fc6cd9d2

SHA512
60f7aeb39beb12cf20a93bb9cf799e5c4ca0dc80a8a7f4609fb09b405b7d0a3e916683d4ad095ae889bdd3467912b91423b040356e369f0414eb87464a7d5b38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d4571c95973da54207b71dc8254fba52

SHA1
5db4466a65f13d5ab7e611c25f4026c613963878

SHA256
ac909905fe442d45a38426db502f5fe4dacc6308c27bb35f67e89c353ed7c82d

SHA512
43182e89a2f2e973d2855c76651cce5e173486013583181128091b128fb76b4c12dd55dd0ecbc37ab5f43467d790735b92bae932ceac2bcc1fe9c55df230d5c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
5e2c4f4715e2781d09ef211b97aef76f

SHA1
94473591aea51b5bece3f197e6e792d4616d71e6

SHA256
11a89d8bc85f8b49ea8330af7782835761e95a16d0818dfa5c8efb02fa7e88e0

SHA512
495e9a0dfadd374b4a36c4100500b5b5016ef433c9320269fcfa30a35a2bf061298f73f62405a9042e35f192994fce1130a92b4532f7e5ed80edfa752fa9c072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
468cb562ea05079e62d4aa2d7d0528b5

SHA1
d76e32736d8f3dfca23a6d9ebb9aa47886681c90

SHA256
9a12cddb125831ed4de6365714b5f8b09876ba91c984fee9830b5c49429698bf

SHA512
060b0cd0157f8256f41982f3ac045b3bdabf183507bba194ab65d91d745d43775655b9e023d171184b55b9696fda96ac9e5f4d82606a6a5d311152603d00bc76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d74300c373532d34a88803e41b8d76bb

SHA1
9d941180b4ee1810326a3bc3cf5daad407b547cf

SHA256
ac73f5583cb28f8c1ea921613d2abf4cef6b0907ae56924b26a67935c390701d

SHA512
d40f02343329518e762ccbae2bc970f797098d83a61af3d3928adcfd83451adbff5546c7f98394103f5fc20af5d1d9eab97b28efe2d4f55b3edbda3cdeae52ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf0ff259fa1ecf2713b44bb7f3d39211

SHA1
32ff1121b8fea27d95b36277319d55ac7bd07373

SHA256
e2abeadb4cbb87651954a5a3d410cdd6dbdcebc605e7e4fe7806857c7c55f535

SHA512
eff699ae257eb5508ce1ccbca54d70bcb35cbada54ca9e5a614f698ccc5bc38969b54ee191c96b44b37acb58ef092eeda518d1a0fa8d65587bfe08c8583b92c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2206a6d6c4a770460698ac0a97175504

SHA1
900be8c9469c08c6902c0bfc6c8d0afd45606e02

SHA256
291ec11448e40164888d8397c846c0d97cecab27403d5f5263e550150fddf132

SHA512
3f4ad21b28aa036c50a6d61c3a1543b89daffd9e7e9cd4de08efd130875a7966b3f978f21d7133b08b44ed65f61a4a7bcc657b9d0e86a0bd3835685408a2c770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8740acce2a892d3b78fe4f956818da8

SHA1
376e05975d2f2fbd52418288827b58910cac16aa

SHA256
9fb3c66550e1a5d3b54d349bf9ac2c31ce6df5cfeba9623d11c8c3c3d3e7bdf5

SHA512
9f9cf57a7dbf739519752cfa60f54af0e271b0a0750db9fc2fbff5f18973626e0da0f70177ee755e54de42f46c2b422739187e1a5577199c152e423dee51cc24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d1890f00f0826e4abdc9a0c17addf0b4

SHA1
5ac195cb844323c160b6add7281aef929ec60837

SHA256
caca9af58f7920d523815ae07e158bcb506ab66b4f372c3c4d24d18e1a6ec407

SHA512
77c2b4b00688c355ea27662325d1af0741e3746def3b6642aa349087b44d43ba8889ee6e47d5d7ab0c4fab64ab3594bff24db129d8091676f92cdf080fbabed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
86ec2d66b65e23969fe7410072e6864e

SHA1
21f2743850353052c910798468d9b9d9dbd6e008

SHA256
7d50d5ec75332ffc3e753723654892db5c877cf91fdb05c9c2cd4971a3ff80ab

SHA512
1d2043c73864ab2ca990227b36fc26056d59f4775681c09449cbbdfe63fd090caf1b204e0c2aee2a03c64da8174b2dc22befc9d3e47134cf96a937d6ef549dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c6e8e7c9f277db7309c157b9529f92dc

SHA1
b3871564e8c11e3739e6c05ac30fb14f216b6205

SHA256
fba4e9d95757af2a4f29e353b96255a987c5f2698afb3812162daecb4316a16e

SHA512
caa8fc5ecdce79efe091f5ceb3de56955ef224375e7c465fa2395f86362a2f1867f1d0039871242b7ef8f87b5f90bbff4a9fa352809ef0d9c2f612832bda58f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
89d3c932e0c4ca1c5ca27fe7dc85284d

SHA1
c41ff0a8aacbf65e49f8801fedbc5753006423f5

SHA256
f293001fc655485837949347dc704d8e58ba7e7280ecc1975afb2a4469c5dc57

SHA512
e0dc56badf31541a9a67160c434cc1cc769bd54c0a8eb309cd20c9cdb7576d256cb53563d8ef4cd7ec9555ec476138477ccc9ed4abee149c874349a2e29f3182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5805b8.TMP

Filesize
1KB

MD5
a0f3c71e70790ce7d6c53e45c5a73b7f

SHA1
6c414ecbd3ecb8e2bc8fbd8b0f2bd6e114270ecd

SHA256
d0e7bf7d4cd092ef58e853ba087eaf2354de4a7d1d0b4bfc16d30e649014adf0

SHA512
649cbabc0580fa16cd9f42f393a83b378806eccc423d66134f14430ef5a5013d593e9489c1b57f1b161b2644acb2b9add78506ab4d79d947be6b938816fab726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a5e483a0a0b7ae47676422a93a6d5c71

SHA1
812dd8d5d615d46fafa1f5af1848a05e7e30856d

SHA256
5003a9842a55372f89056b09fb70e3cc7146685047af542915091fbb6e4a5872

SHA512
8791ea174637bb42b607cf238c7850c2baa87dda3a89da0a8d5653a4b7466f506b68e3e15fafbd105d0c9551b93078dc1ec03d1ac1eb0f849130632ff87811cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8a932584d140c5fa216c573e06d1aaa9

SHA1
316756a92efd9df4a524fca5b92f0afaa42cebda

SHA256
8c3e31bb894cd462329c8d7c2cbb333ab83a5e792b648d5210ed3012208bcc59

SHA512
730417c50bf65f27377ce1df6c70fe923246e8aa921e8859dcc0084c0c92429d346a52de5bd188fe5498a5684a0d3bbc08babbc99f7543a07685eb9dc25450ac

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 620926.crdownload

Filesize
618KB

MD5
9f4c46e77ccd7f549be87155891f52b5

SHA1
4e65d6b8320a65f28fe81fd8fb23fb90f6a8f9a8

SHA256
2a2e31cec6518087396bd7307ca7f0e0ab8323d2507d80d23a33598244b5cb16

SHA512
ea703fb0240b2b3472fd509eb8347413b9af7fcbaf4028b8c2c54fafed8ad2fbfc31c161d16723bb66da2769bfb5cbe67bb574ec93ae8b92694c6392b283fb02

Download Submit