hxxps://drive[.]google[.]com/file/d/1M1WwmNeQa-A0nnqfAltSekuOUlqFFldC/view?usp=sharing

Analysis

max time kernel
26s
max time network
25s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1M1WwmNeQa-A0nnqfAltSekuOUlqFFldC/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
10	drive.google.com
11	drive.google.com
12	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
3856	identity_helper.exe
3856	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4500	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4500	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4660	4296	msedge.exe	83
PID 4296 wrote to memory of 4660	4296	msedge.exe	83
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4628	4296	msedge.exe	85
PID 4296 wrote to memory of 4604	4296	msedge.exe	86
PID 4296 wrote to memory of 4604	4296	msedge.exe	86
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87
PID 4296 wrote to memory of 1876	4296	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1M1WwmNeQa-A0nnqfAltSekuOUlqFFldC/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb517b46f8,0x7ffb517b4708,0x7ffb517b4718
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13624602237738049604,16713835597840011634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\337c1dd2-b38f-46cd-9f44-e327b0874532.tmp

Filesize
10KB

MD5
983414ff3b1eb5111439adc3076f9e32

SHA1
8269355564433f327506bce0ac2cf2f3811929c9

SHA256
32dd38785d1430197adaeab0f82b73e917f2b2bf46efdf89777488506a85edc1

SHA512
699dd72ac5d04ab280bbf3fffd73b4ca134aec33393ed87666a11f703e704423bb9f459a98f6a2a77beaeb15c3c577b590ef6be6202f39af01e67998b5401400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a259b7d1674e0b54ba489fe6438d9be1

SHA1
e02809891b541c9706455a6c23346ded594bf051

SHA256
9b1c98178d61a97931db5e789f04cd677e0a87c8fbc04f9ab2da058286544fab

SHA512
5ff3f2424e575976d9e885f360c44572e22a878032756325f8bcb5cf193c2da2c6231ac4da322418fa020181c9c2c41a581189d944a8252acb3ee12fdc7a05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
995f00ebb51c71b6b21803f037b98ea3

SHA1
94283f662dd11169715557befc2fa561dfa366a3

SHA256
0048489ff49b967bddf2610772cee4349be80c09a85e9820c13be0941676e048

SHA512
6536edfa478889047b56658a463311f1607794d3d512612a97feb517b369cb969286d3003123c0a7c3586909a3e21fbaacffb7b9a631c9148dcbd4560a934d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c8006f1b8fc5df8b073e0990a7fe877

SHA1
93abd77e0e24c91d6fa26bc4c351c66491600d1e

SHA256
8354f49742d142aafa72d2ccd7739fc039f7603a9ac7ab67f4a0e07dacdcc11b

SHA512
684dd9b0d7c05f1a648807faaf851d304d9c9342f50a3a6ea2e596008c4fc60bcefe9ea572e44ab56993219b3b3aa546ae7cc9723515103ba87f6733a9562a5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
1e69d949f60952e4adb6ea9a0832b4be

SHA1
b5e7895d39d74cde7dae58cbb76d0dd86694ad98

SHA256
01a78670e8d55d4a80b2f349f647a1b6cffee3ee7d7dd1a991019916ac583a83

SHA512
5754213a4ef71ccb836e129cd8fbe0d2a35bfc7c8c615098ebb76aafa22f7739abb2e8bd9ab2bf61916e37a5540b63ca663c9e8026b71c309e05e77812733eef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
8b21b21bd62f2f2b12678c6ac2749dbd

SHA1
33c94b0e710f90a707c824e76af94a767613d71a

SHA256
cbef9073c03e3b9a8b491e8802c2eb0bfb102483b3e93c66d175b34b205f4cb8

SHA512
ce82a38016497a00fd70f9f6af5697e0945cfb7ad3d616e875fb1f1fc15c27c8a63362c8a0d15d368564ae64d95713be35724837d1d15f7ee71f09d8f93b6a24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57b49a.TMP

Filesize
89B

MD5
61eb609e699e626af421df76ffcafd9b

SHA1
d81d548b3805494ca8506d3e151180b486fcc21f

SHA256
63fc4a300d90c96e19ca5ee0e08873022949e23945024ce079a5a3402096b343

SHA512
84cdebf561f843243c2a7167d7cb6d1aae3afb476d7e160a3dacdadfba545abeb0e74f66074f859336dea76dacf16081bd50a237a9710c4a8e62615ea60f3341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9126101f775be215769afea4b09fb5da

SHA1
fcc49e2235dbbc754076d15ec9ed2beb8ead5900

SHA256
a1970bc89f1810f35fd0f3c03ec4eec8faebced5694abe5bfd7c1d6a079c23d8

SHA512
42d75a9d71391fc301404a504f8da02b0bc124a54af79acdaad135d4a2fb28f6a2c89ab5f7f4e428a80def8ee725ac7f054159976832ea9489ccdcc4f1cdba33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d0bd.TMP

Filesize
1KB

MD5
095f7836875532ca554b3adf05e429e9

SHA1
b90b9e547e4ca30abde5bea905c86e006d2224e3

SHA256
163dd60ddca89d87584f0be23cdeff5f8c7f823827c80a3b80ec2f0398244750

SHA512
c1ffb85c904c434b13b158b804c6775e299765ad24b1f2697f64316ab5d2014807d53fed4d26c8fa41470769b140a1c81882818d43e4b79d3335de00ad36dabc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit