hxxps://drive[.]google[.]com/drive/folders/11PFId9Lga8U8oYjmEN_PDTZ5T-oh1iMc?usp=sharing

Analysis

max time kernel
85s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/11PFId9Lga8U8oYjmEN_PDTZ5T-oh1iMc?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
4032	msedge.exe
4032	msedge.exe
2852	identity_helper.exe
2852	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 3268	4032	msedge.exe	82
PID 4032 wrote to memory of 3268	4032	msedge.exe	82
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 116	4032	msedge.exe	83
PID 4032 wrote to memory of 2520	4032	msedge.exe	84
PID 4032 wrote to memory of 2520	4032	msedge.exe	84
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85
PID 4032 wrote to memory of 4924	4032	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/11PFId9Lga8U8oYjmEN_PDTZ5T-oh1iMc?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb91b646f8,0x7ffb91b64708,0x7ffb91b64718
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2788 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13671976429393929413,1474194162377309923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
51KB

MD5
f61f0d4d0f968d5bba39a84c76277e1a

SHA1
aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

SHA256
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

SHA512
6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
32KB

MD5
1f76396a01f9b997d149642fa19395bd

SHA1
f26dd69ff0c45d7fcd9553f0cc5caeaf5410cffe

SHA256
c519c5d085e60c32c52df7706f00daddd219415a5aa2c45d2d7d9dad1e5ac849

SHA512
0153e322815e320bbb18042488bffc0bd7a7c6c063c9919284086496c58865e4da89b3606c0f58e1b7c0a07380dddb2e2a59f967966868c21c26670c215064c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3e7f9357a0068d08db567fa09e60a79b

SHA1
787d906d6b21e731e3f1f8f6e75c256a84026b50

SHA256
83bd230729354f14588fd1797ac39e6f5f876ca17039c09ae5203aa42179261a

SHA512
071197e9a48bf652510e2c22762c65a5509b3210a6727a72fab270fc411a9f5ef87dd4b7dd6fc838e9e7b36d511bc24b50a5ad1c724ecf2e52ee57dbc615f25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
df859d9b4c163af50bea9dbb04620d3f

SHA1
bf2a99267a4c28947f80d6175e89a4943e13077d

SHA256
4b243ed3351a2a3560651b22a70bacbd3b9193468f0fbd9943ee8ddf9310d828

SHA512
b1f3425687352311e3005d20cddd2fcb9e12f9f42fb8ef1bb38e51fa0b2ef01294fe4dc416ff64acb9bf03ef2f8d37c1092c79237eaf3cd73811c9939545df75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ec773a84559dd2bbfa3f7a2bb813c731

SHA1
8d302011d6e70f05e64bf10b156d488ba6bcfc0a

SHA256
5a055e9d0d3b332cc10903eec40ad0aa5e515db07071c1f5dc241ccd7a193db4

SHA512
f63bd1d5e2dca86484ba41d6fe5b928c303e50a19c6bf09fa6af24cf6eb975e66943778308c88f6a4787e2addc7fa784bbe6d80d06eee62a31c45d89660f8bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0e0d388c3fdfe97b836e6a79e00803e4

SHA1
6bde9784aa6a5038f3953261999f59af2c5b88ca

SHA256
3b208bc223b6c10793c24ee94d1de18581d2f97f0f77cae6910da012d0c2c766

SHA512
be3170a3281111d302434d361841a7c27d587d20bbfa7908d3c17b7769b51c53abf6f8f6e991daa0a6cf0a7ac71f9d9615918ac25af8c7a251303c9978154cc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
04cd3f327c9ef8e0695dfbdd5f8c43d2

SHA1
534db73686801ec2f492d0840c1ec2b9aca29224

SHA256
9c11f3a941c009b8f05997af912c5bd8bd0f22803207d514dd0498bcb236f7b6

SHA512
9ebd7c92fe4cd732894e94c569dfedcfefa680d64dae454fc5c40991f0b154329fe1cd9b603203f3a75b2a35afa8c5c6b74cf590c9e37fe9b256332bc4cf6cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbf698d4f09fd0d1c9340b8e31788a27

SHA1
6473b588866a90912959f7f225f86b943d547ff3

SHA256
4e1f26e6cd3f0b773fd3725429731f8399b459b2b1cb385215e922c5580bcb4e

SHA512
1f79b9494865e47c9ed1d1d906d89c6161c6470d6a973a20a6864b9f31cc951854a128ae27aad273eb984e1bb039d8ad305bb0372e373a6ef436e39989d62852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd0c499b0d315448d3098a357578c294

SHA1
ce04c754bfd1b2a53626dcaeb9b253db45168a2c

SHA256
698e14368ac2c88d8350470f8593e4f3e6aa57bfcdc7539c270ad8ed6558ca1c

SHA512
8d4b68b596e15445f1c4e225ff30b588cfcbef65988f584853e1230c415d54b52af458b1e46edf933f1df6884e646f5ed5c3af15201cd510b13a9de90d9208a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
233863f9596df86757cec4bc1a745711

SHA1
bb59ef7357492c48eddd8b4f0d636e9f4d82afc6

SHA256
2ef4deb0276c0e15e53685347f7f8225260d1887fd799c1906a7e0fe0073873d

SHA512
2ea8348f7f922801abbeffec4b019fa5db9f59fe5e890b9f9dff2c97a2ef5298c9ef7f058e6c53494939271aab5a736bc2658c3a4c4b8831b981ac51878023b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
403f505534457e3c25e037895150a0e2

SHA1
cebb483110900dcf292117d379b6ec3df5d97f18

SHA256
be5b3dd46c4eefa20e099a397f3c7954817a20bea181e627f3d61c76e636988f

SHA512
63a0b2b1fe8d3c64ae4cdf1faf0343975dc4d378bdc3b3d5fdd2423fc83eaff4b3f8369986a157ef871e1f68a25396acb86899d7e8ddc7bf63abc3948b03fa8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
401a163f24e95ccb42d2b83f3e72897e

SHA1
5b3cd319599e56f2cb4b2637617d2f0ca2c26680

SHA256
e3429bf8a18b84376017e7220334938c4151ba1795ce8e5f7f7dd2944b4e3649

SHA512
e9701cb2002aa6c04d75191b4344c2b38bba61f4937eec50c985123eff7ee5c041119fd6d0ed1d965c0c209d599120c93aa1724a9fe6c20f13a9b0637c81846a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fbc156ef4eab8ef02ac082f0529fde5f

SHA1
0b80fe6465db4c6a2ebd9afe729c896b2616bdae

SHA256
6563b11c65976d406bee6d25f99a3dbbfe8c3adb26805ed88e6c961a158ca8f9

SHA512
b98b4238d361ef9fd1252b31c9b5d8413ab8153f8c1586ef00e1a688bd414fc0faeaf3741dd109fe9e95dec595fce13bc366b437d73c330eea01ee4df856e7de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5815a6.TMP

Filesize
1KB

MD5
cb1070a6ad1f6ee311deefedaa7a5f44

SHA1
78d9f878a731ee15c552da98b91f47659dfde993

SHA256
ba2100c947abec40c3193208b6b331cc0e1d52bd44e80819ecc57ae914270a52

SHA512
6869f9301861a6693ce7d2f8399d4cee5b992c5a07f38c6548da45fdc25565361d7e85d1811bf6f625b20f4a43828ad26daeb8301b2701380ae73dde0319f512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c86d604d-bdaa-4f1b-a2b7-3464ccca94d0.tmp

Filesize
5KB

MD5
de7e4a82fc1a567bd4571740a0d009fe

SHA1
9343acbe01b49f65e56902ca56bbf26494f2ccf1

SHA256
8f1818cf73343545976c52187fbf2b8c65ab67d6542370fab48ad813becd26e0

SHA512
76bdf11d463fa471026ec16c4428018af33539d805b312c42da61e3018ca16e851db89b91e9df71590d71775a486569dc6e3e49a306544377a67083c6b01791d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8fef58b7e1e3a8bcabc18352314e41ad

SHA1
307b481dae7ba9dbbf280a0f5c759c156d4f8bf7

SHA256
61361770cf6495d3e152e843984aee09f8724bcf53d38a12785b04da15869369

SHA512
1ea4335d33190a291a5c9ed413ba11ac9d2a88ff39262e77bcd058afd4e69f827e30ce89f937cd88aef1517f4e6aecfb21139d1e03b488eda655dbf478cc0b4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
58e1a3ea28cd3f7e1ae7fe58df8e2c6e

SHA1
efc43a5f50f6286cd3b37c0f2032ae029709b69d

SHA256
e796180db9b0050b7aa991b1a479f50a31071fe49f0682cc9099c9e5f04b8170

SHA512
5f1296f0f992f00b5950d2e4ae1b8c03f81dbfa3f6814932bed3e515e984dd7633a265859bd809978138974099043a185d3232bee10282bd46d1ed992e080371

Download Submit