hxxps://drive[.]google[.]com/open?id=1gbvomA7G1AepMLTMyXyEp_n19YVVu1ko

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/open?id=1gbvomA7G1AepMLTMyXyEp_n19YVVu1ko

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
13	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
4888	msedge.exe
4888	msedge.exe
3236	identity_helper.exe
3236	identity_helper.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2544	4888	msedge.exe	83
PID 4888 wrote to memory of 2544	4888	msedge.exe	83
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 3296	4888	msedge.exe	84
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86
PID 4888 wrote to memory of 1368	4888	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/open?id=1gbvomA7G1AepMLTMyXyEp_n19YVVu1ko
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98b4246f8,0x7ff98b424708,0x7ff98b424718
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2304,354801297978652185,6095903963572147059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69a04244-5d16-4359-bd99-944078e7772f.tmp

Filesize
3KB

MD5
efd154d9004613f5235916c4dda841df

SHA1
4ce7323f5a4aec6fdcb056bd9903043abb3147cd

SHA256
c4a87eb34fbb6f41fdc1bec3ccf9d82daff38e052a8db348e233fc89de559879

SHA512
5e88b115f6e7fb1c2e07144b8b3a1bc7d8e2d7b351f9fc475054618370993dca61928bd0d8bdd1b9974663f438e162778ef82a460f4cb6fb0fe003f81b825b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c4b3ea3-4a9a-4c54-8807-4dedd8c9c07a.tmp

Filesize
5KB

MD5
e16165f2f6ff69b6aa34d4b1cf2f3a30

SHA1
9f7cf5abd07bab638b9d38b6bc9862c80339d145

SHA256
db2e3cdada283091f76aced77ebccf509eb830aadb2dcf5d0e071c3aefcf589f

SHA512
ef68fc16c803381f4581310e98ab3d26291a490abc5759f8833a4c891c5b460fedfac13e613219b719c29849bea196361741b32125d353d812a25d51ae238c11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
67KB

MD5
27d9344de055e50044e074ec3b54231d

SHA1
d07ff356acb90c9d4fa1c1e3e48188b1a2eeaf8d

SHA256
d5c1eb2d4d0a13aa42ee68f03218ae01f420003f64f572b77cbff7d61edff388

SHA512
ad045b2f4e6d58e43de1e26a1d5c0a46d912b65caed68ac4bc07f0c26223c5a9927a74ccc8956e074ee74db6e7b05415f3baa3634a714f3048278982bcddf26a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5faac25acf5ed49cf4ea7f5f8136b50b

SHA1
3fd9a8b69a991d6a6dc233d8239df047cf306140

SHA256
6a3f8580b9d7826f4fef04e9fb8966ef9a25b6e475ad3f39ba690eeb0a4a55f3

SHA512
a17c396bbdab30ca1077a80fd252698985f4b8fc225dcd570b2f05c9b292f4045d7f5dc8f048b438987bdecf993c24505ec8862240574497965ee3cf29d6f7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
9814b707fa8ee7b07af43a528175f41e

SHA1
a4992c7e60b9e5c0291dd1894bb20c001c133d0e

SHA256
fbdca55f3a00ac68b0e8fa173547b60ab22ed28613d93b4d0d63edde0435167d

SHA512
5d74223e25b0ef00bc974562a3ba08bafb830422f0bb897a531231ebe52d4316190089128d60da1e2d203c25b6c6f81d0ab4cacb2d41dd95531a20c3022df619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
17caeaa66339e116d306698914b4c9d6

SHA1
fde5d5ae2b9e8d61631522006ffc65a2c42d51bf

SHA256
50051602f337b76ac6f2b5087f88ed5bc5b3f8b66350aaa063c77fa791b861fe

SHA512
445c106e6b85ea542cee37e3ecbaff881c9a40daaa14174d3e8d7a7a7b5b407c18b55622fb772b455273c1d06800c12d6aee5ad8b05949e619497e8b17baff51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ecb3b165f5d7f9ac79821dc8365fafe0

SHA1
a27dfcbad060ad9d887d6623dfa9163546e83531

SHA256
152813f91a72cdf7888265882481b172adf7a7ed8690a7d8d7137283561aecfc

SHA512
45b2538576be39a028c65f504300fdee6f1431770a379a3a0ae8c3e16635b3d814021b21b92b7b7341580c278306d458c0b0bdea6c76b420c1a3de537740d256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aefae7eb7acfbbfae6e7e6dd283c353e

SHA1
9c50a2e83cd3f46d12331cc8eaadd09057b83512

SHA256
96b1345780d36ba300466f85030c4b83a2a09664494ac1047f49f747b756d33f

SHA512
86a12e2a8de1080c2f2d21a904d226fa57b2692f7df314dfb8b828c005ace4653df556f22f85254284bdf1fe505fc4372cd1474a91f6a5c75816605606e3caef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
896b3d93e0ecac6d1ada8bdeb3a0b14b

SHA1
b7fd3c18cfb3467e1c779f5a749a9b55673994de

SHA256
ff4f0c3d6cc4e2e20e00bac2e4406f9f4186b98ea96bd63915b597d4cba0d95c

SHA512
9ee625230ef1580922c3527209e749b29ba7cfabbbcd2cf4dd1fab0bf217335f172e23c7c6aafc0504576dbf3ac79417209573c04122a7e733e93b675d06d5b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86c01c361286358884166bb0bd853969

SHA1
2fe572be5737d9d853176ee2582d89dfa46156bc

SHA256
4b466bdf8eba0f21a4c7444c011fb580f405b24bf3e1834f8fd4ae008d17f406

SHA512
d71c81ed2add634fbfa23b7a608b082b97c8528840bd68ff1dd2b5d804773a667ee6643b77d4c94d0e4c3686b257ffba3b82a3078e4a33fc22983b021b89ffb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4d8f169042ffbcc48d013ebd2a093e0a

SHA1
b6384bd185e0fd66fde328e034a0b218b24e0f2f

SHA256
1945ed4f8adca76b10a1ad70771300ae36ae9dea6c03268478e32748a1421722

SHA512
c704f8286db9268c21710425663d55555d4774503eabd8ae71c3031e51c60d25448b86a6a7d75cfd502eadde52b0a082a11d8d003bc7cc0da968123de829464a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04858befc6e2e9b81ba25a65622a9969

SHA1
8a717454fafe34be412a5e4c0f87391cae9ae7b4

SHA256
f9a3f281d278d64acee432af7f75c87e4fea45eca02a8ff82573640b8ef0518a

SHA512
e9d13b2babc1231344b155f3c203355932655f808ba164ec34c17195ead60caab2a94b03b6a099566387d8b92cfbfabd12946c76e873f7460803777345cd722f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
95c42c4db9c71b89761a98d4d2b38800

SHA1
534a958416fed5889069712ad44219152b2cd768

SHA256
9ff03995e51eae79e65d7f9ecf42d5dc371cff56788d226abca52efe07918fab

SHA512
9bbddf7e058ffa29d1cf07b045a485d484c74671fdd69d7cfc17ed2642eb48a98c00ac96f49f2731e786cf2a83ddcc8da49ac574c4b1ce489bdc5d83e8797d28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9b389d4a5591137636f726abb8e86b01

SHA1
22b83c1bed23ea96e1690e467bc9fe103a0aa888

SHA256
9d80a783fc6d7f8c1c4ec05679b1c0746011191da0ca0273e51c1d51be15c669

SHA512
62afd80bd448fc1ff10b8a98c88a9076beeabfad24c66f795568277e3f79cd5a5801f263b5fb42f174c195e86fdce1c29e7a9611be6555f12a4b13226625d8bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe595673.TMP

Filesize
1KB

MD5
12c274612edea270898359e8eaea6e4c

SHA1
81b87a63c411ce48719dc992b2b301ae7eede503

SHA256
1354e7dc45c90ae8278561fd9ef6bef512c4aabb0d8e45f50ad4780403fc8d59

SHA512
7181ab1a4cdd5c0ee0b7e6e51fced4e19701cbd7e64ddf9ba801c6f54c00e6aeb55aed1b1787c56e1011685d0fb7cbfa906dee8d94d460247788096d963a33b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f7e1c9b9a37d12ac69de530238f900b9

SHA1
4c5be1e616e09bd356dc22aba6faec1be21ee14f

SHA256
577a99f9c0e369e70b132d211cb68d507e9e08835f7639e98903a75601678a23

SHA512
036dd2236e5d3763bb2ded40d754cf14b1a7e16919684894b9d15a7dfb756b4369c55028ebb34ddd92720215ab03969521a0819920e239778afed813df74766a

Download Submit