hxxps://drive[.]google[.]com/file/d/1uugHI33mlhT2ipdt4-9gxvfcWEErZ1Zx/view?usp=drive_link

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1uugHI33mlhT2ipdt4-9gxvfcWEErZ1Zx/view?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
4928	msedge.exe
4928	msedge.exe
3100	identity_helper.exe
3100	identity_helper.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2236	4928	msedge.exe	82
PID 4928 wrote to memory of 2236	4928	msedge.exe	82
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3436	4928	msedge.exe	83
PID 4928 wrote to memory of 3688	4928	msedge.exe	84
PID 4928 wrote to memory of 3688	4928	msedge.exe	84
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85
PID 4928 wrote to memory of 3508	4928	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1uugHI33mlhT2ipdt4-9gxvfcWEErZ1Zx/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9396046f8,0x7ff939604708,0x7ff939604718
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,15210016792414835437,14813692837706021446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
24KB

MD5
2b77b2c0394bfd2a458452006e617f96

SHA1
11eff89a8e3e64401818f81a02bdc84e8ecc4325

SHA256
c46f001852fd8e16bb731f21cadcfa0cda8e7d064e11b0faa18d6bb8325acb1f

SHA512
21dd89b9d6874539477e8b8dc8d98877c86595a8b0b8deb624547c3f407fb41550f65ff744c22f25c574994414a28e73f4d0794c5bd49be890fdac7906f0ba30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
620a2955abc334675ba6e322cf93b3bf

SHA1
9384dc9cb2d0a93fcd7d91081a3832ddb04f3660

SHA256
d646c8b1b889ac29bdf4fc4921a16e0a25da0b304939cc3fd261a86a63af2eeb

SHA512
e6a8cd3754ab853c198009e176ce8a2f18c9337d34d074c76324da62e6ff68c8758d8ee131d9cc974e00923d75617674cb19859ed5f4f3493a07b7b609e3c22a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
d38c53331a01150b68677be6a616cea4

SHA1
ebc3845db3568d4e6f33ded69aab90b463f2c6c6

SHA256
6144691d06f0fdf46d093246f7fe6be763127b798cc146ed4a1010112d6d2683

SHA512
d59eb21bfa46d8a5dd45c1447e4416a570671799b5bcc45d157cdbdb7a44d977e3324339cad70691a1351f496a129285db601d8ad01759e3bddc0c05ce3c4478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
dd2c37e1d84fa44786cd114960d1e501

SHA1
84ba4427985d635dccb41f1955c06f1b9df76b1d

SHA256
bc605451c0c8a4049799824024a4c0c990eaf70f24f40aa6da2b18c0ec0e8e60

SHA512
618b1ab73f5f60574c0d7a8bd01911a447db0d133079f3eee8b9d0f818ba78254c90202140a184c6de464d8c6c2a90235dee3586c04476a23f7fa1d766087417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b8d7e135cb7aef28f32e50dd0315acfd

SHA1
1d2ce4b934a980813b88de25aef7430aae067452

SHA256
be396efb6284491b6e761f7946e8516279c54567771503f6f57554e527a119db

SHA512
d8c9ca2b62d9825dbf9bc3c5460b7cffe9b841eee1ada84bc91e024e219fc9d6c7c899fdcd57ffa6cc556c62e08bf4333e2c195edece5f4d7eb5fc52e47e371f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e6a9898d63f26ebab57174e549285a58

SHA1
b7b9b7eb8c111846997278f4517e1c9a2202d73b

SHA256
c5aaf863b688af717b964d370e0a12febf9b0a7c3ba502b3ee0cf83a7c05686f

SHA512
ddda23fdcd85ef5a912fce8c3091d1b8b31ce33b92fc095fde264744160b90d32c2768fd491190b014cadd5d566833d43b3e1eec4499c823fb5ce96e212663cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d826e3937b94868546ca5b601b5037a1

SHA1
3465eadf75f5107c0e0492ddffe70aa3f229439f

SHA256
1435cb31134f6a7eeff2b8980dd03b1d52dd3e0bc761ed5bc54f7ff7b54550a4

SHA512
de5b6eb32462d69c5b2d9d90836ae76fec5b883d00fc2a863618595d57960cd11224b899c70feaa37698cc7f0bab1c584795cd91b2dd475244cb118ab5e3f61d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
092b8fe42c5555c797c40ec5e70b0de3

SHA1
fa947d1932d29d2976161b70414ad6f27311be1d

SHA256
f3be90cc0765206c9fc8dff394ff17039cf19e854e04ee8153ec2b89a2eb0fc2

SHA512
224793403288858375bb6b68b0b3d655c97d5d30b8f32a4c9b5128e636c13453d1cf2529b19c5f9a8a1f8e1437a3d400d21087de821a93e1aa90d5b51f2032ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a226ef696270354fa6312e900c3e915

SHA1
754baca9e8a992f649f1b064e28bc8383fa3aff1

SHA256
08c0c2ed83bde1faaddd6d637a8d3b51c823be51e04bd268bcbaf3bdc0799d24

SHA512
075bb81e08b9d530ef83e76a50845753ca32f3819765a059ce07624a168ee1d7ea7ea8e2d34f05664e2ab29dc3ea1e882bd23a6aa9dc183b8ffb86ad4d96e7f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a5754c1f2fa446f6b9f365a722d564f5

SHA1
c247ad64e5d63ec870d636b72ad46b617cb1e197

SHA256
e0df067cd0bd92ab3bd81aab526a0c42b4d45e7669e432d1dae4a437c5934b25

SHA512
a53cd8c6defc7bb947c6d06ab2fcc2de44657c353fb68da65926a8cc6edbd973a16e877afcf63a664db576a0df0236b92af14a2ede3e161738c8abf1707b407c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
783ffc8509813d4e65f6e39777f3a088

SHA1
fac00f147f790a80c95a66d5b98ac7d24a122398

SHA256
5e994609400f7987ec394a7ae42a44f8dc3265d63c9b8da56dc44d001d121721

SHA512
c96c08f8fc0c7558ec67271919f78b98754d0d6138d6a9409aad7db52afd4c1cc0425ab7b8f8361fb7d6ec9a99a7a9591b9e3d4e709bc42dea28a60486e3bc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
501d256e09875559cd4f5982791f11eb

SHA1
07dd42d096790b13f44ca83f8af42d83d3624a45

SHA256
337293c0a1164f27d95353b6454e9ca0727523c6a01b1302317f9fe672a1d16c

SHA512
e45c1e0cb094b19d0831a5db4c0ca749b5d80a4dca0140268d76bcc25cb51518ef990648775d1d40fdfae36933c99bfabe6493cad0eec3e6150c6213bafbc5c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581057.TMP

Filesize
203B

MD5
596c9f5182a1b5fb858da120cf756330

SHA1
a4814651309921c7b05ce2e1d4a3f778946f97ba

SHA256
112555fccfce8aa49d0c772db12a62845a36875b27f2e49d88b141a99b4d4120

SHA512
bcf198f034d6880af2ba009b7a7df2e85b191486fbf51a13503fbcc8af3269ae93f8d2337c3d08337e871ccb72ac5debdb73334722a9495e7af2c70562aaad1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8a400ec2a6ff71548c531744ddc84b50

SHA1
773135a4fd43b92f82a7effa8922dc62c0db04d7

SHA256
241cc961a6258e13b1009db22832adff3cf8d7a5afd7b40eedeb975ea9b6c747

SHA512
963c775f18e4dcead8bbe85bd31c3c23c2b2af167734858c43688abf82494cef2a904e25d30897855a984d840e9543335608f95c83bc7897ca8feb7320b21217

Download Submit