hxxps://drive[.]google[.]com/drive/folders/1yZs9XR6AdkiG_clB3dwu8LP0iw2Ua-v-?usp=sharing

Resubmissions

22-12-2024 03:17

241222-dta8ga1nfw 6

22-12-2024 03:13

241222-dqsy4s1qap 6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1yZs9XR6AdkiG_clB3dwu8LP0iw2Ua-v-?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4248	msedge.exe
4248	msedge.exe
2952	identity_helper.exe
2952	identity_helper.exe
4468	msedge.exe
4468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 920	4248	msedge.exe	83
PID 4248 wrote to memory of 920	4248	msedge.exe	83
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 2016	4248	msedge.exe	84
PID 4248 wrote to memory of 4492	4248	msedge.exe	85
PID 4248 wrote to memory of 4492	4248	msedge.exe	85
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86
PID 4248 wrote to memory of 2420	4248	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1yZs9XR6AdkiG_clB3dwu8LP0iw2Ua-v-?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8736146f8,0x7ff873614708,0x7ff873614718
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2596 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2204,15312378508664843910,6537707297359465665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3720

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
24KB

MD5
2b77b2c0394bfd2a458452006e617f96

SHA1
11eff89a8e3e64401818f81a02bdc84e8ecc4325

SHA256
c46f001852fd8e16bb731f21cadcfa0cda8e7d064e11b0faa18d6bb8325acb1f

SHA512
21dd89b9d6874539477e8b8dc8d98877c86595a8b0b8deb624547c3f407fb41550f65ff744c22f25c574994414a28e73f4d0794c5bd49be890fdac7906f0ba30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d20463b4dd6a9a402726634d36e7afd3

SHA1
0a98ed6cf7a2b71ccafec92620ba5aa8d71ebca0

SHA256
7bd01d9776ec0c00227b88fbe88df630724c03659fd9396e8132ee560b355640

SHA512
7dc17dd5372d0f991d23c1821352201cce62c8143b1a4ca6d98827e2bc6196eb58bf30b02881db38bcd2b5ec983fae4b0c0df397f1817acd93c87ec817179bda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
232bfe364394ecbe36d28ec5b34a56ae

SHA1
903572a027d36c008efb251b732a4d561316ae78

SHA256
8434366c0618c114e7a2af5f8a434f61fdf661ad584cb42c88563578ca2c9cc4

SHA512
244db810fd144ebe1a82103aa3ed647efe3df9afda767dc0e367462803edce804d1ffb7adcbf46ef3eb03a8e56040f57386be6e7e9eb63d5c039233abb8db28f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
42bb7a39b942db470e00871f53ee0b7f

SHA1
5c5e9cc6e02b8d71fd9874caecf7fb6297788a95

SHA256
828ce3ef55b31d5e2e75084dc1ccf729213421fd32106e6c78106f270861ae28

SHA512
276692b341d658d86f1c2d09e3e14360aee0cae9e49ab1e2e99c217e2126d1020b2a1b4ddf6e3e061bad5a4499f49b4c8bb2019ac4d217c4ccdd7064a5b1c1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
466a287328966f3537ea28cbd3bfa3d5

SHA1
3799fc2a2c235736a1b5c7677fccd73acf24395a

SHA256
f365c4573b69537e19573f15be859a0bf9eb270d131d370f51399e18e1aa440b

SHA512
b3edf06768103f6a28838cf3a37067adba270104b9dd10f67fffbd557439d385a3f4be55283cd5d0179d6979ff8a255895d655ac8086a2820f1f0b67ff75474d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
566418d9b11326455a4e80ad72718993

SHA1
af9dbcbe0f90b313f530053d6c528c002252a677

SHA256
2200e3c16a5b480b667b43dca6bc0e7012a8ae560a53710d35b02375cc6ba7e1

SHA512
569595402784158986ace10871462ef9dde9321a1a3561af68ee66f06d1fa1e9846b8d10a20696d12f4aefeaaadb435eedbc1d1d88c3d13bc6f2b34d155cf4d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
34f636b46f9f5f94d4813246b3a9ea94

SHA1
e023a1ec099f36dec5fcdce5dac17667715b7eb0

SHA256
e317df599edfbd1bfcf568f6d2390ebbcdff96b9dcb651fafa8d1e34b51f5d58

SHA512
bd1d4e05e999cb4b2f8468e5811959eee00aeb27099378885915bd9c44a9b983e986b314d61f6ec1d8a34a072ae95686868a55f18d17a8082214b6e3cb798076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03eb5d38aa790e55a648942006a40eeb

SHA1
2f92109d37a15a5e6a88ec00303031635db5026c

SHA256
6e14f77e9c491b8b45a22183362ecc13d94decd933db19bb45a6c4a95c4e49e0

SHA512
17bce206de630ba017e58cbe588ed77a92e32423e1c18d90335ac8fff2b3f11407621613c8fc9e9ea2d05d7fd07525617902d63c0ff3c0797de57552740b7212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
03405c41233f161fe2217806b5658a43

SHA1
c16834f54adf79bae979db376d0f4198b69e3a17

SHA256
86cbe002617efd6eb6338f59974be9516502fe44919b7e95288fa2f0b6a419aa

SHA512
d18c0e878855518a905636290a663e2a2ea65704791a8b84523f9d418e3cf83e8531354737f104821c854eebe2233ebab70b66f8daca016522daeb6c9ec9fea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
29be738fb78df25b06d558d1cc9e1e91

SHA1
9378d9909e77b6e8b4cfcf7e2fa58262e3c5e734

SHA256
acc3e3009a7a92edcea722012d3346dc9afdcf1de12e6f569562c9557f222267

SHA512
100dcb35e50246420c76e2816b84eb8c2807c3f139c7e6047f8e10e557b48648bec94bef50f34d73bc5da13c6e42ffc243bc3cefbbf6fc5836e23f74dc3fd8bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5821eb.TMP

Filesize
1KB

MD5
df9cf50461a8264228cd252e81efe1a8

SHA1
01836f28b8c3240081ae4327179ececda59a959e

SHA256
191812ce95f478f989ad87a44b2987b3ec41b24d6bafe63d2c38c4aca8ab8c62

SHA512
f44cfd0b2057caa422a6cb99004a49e511233dd2c020454300c16e9d888c23298ea849fd3e13e40a2e7cb8633435170ca48e6dc1df5da04481c08eb826ded18a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
24a28131187d1e60fd97fa765e7edbde

SHA1
9f9d1fe84b4bdc0c3aaeedceeec6007ce596aec5

SHA256
34aa9ee28a39eb0a0ef5dcff54ef80d17fab4583780fa1e4ca0ebf11dd0f5662

SHA512
e17dfbd605801fcd351831cb3808d622fe0198665b3e7979bb662009d0dd678704eb9318546812925a721e54cb5722e48ed386616fddc92bc9b4e9833b1c0c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b6bbc0cc2f3828bdcce8241f854dce89

SHA1
23ca21e174b9d389601e338444d60f17860467b0

SHA256
f931566fd7dd4f22473fb9aa6036a0611ef753b736aa0f1ff1d0d4a1c829ed34

SHA512
a6f57e97809db9eb279677c3fec4f40199c53067b9516ef6bf902f6a7f5208662f7c3324568ee0f03d8f64f3dd80e5ffe0f33ffd426398da0210ec367c90fed3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f77e64f1d8aae954731927623edff0c

SHA1
eb6e289af75af57dca0e2ed76979903cf0218283

SHA256
d84e1265c50f4c01cee9dd0c2e9ed8ba55a3c2cdc530a4841ee75b01f0d9a44c

SHA512
1838344b907b253ef61228d0657aca791b9452e0b420f8190ab3a98c8c640aa47809fe7c0c89b96c669f209e23548009bc7100052dd4ad26b035f420856b6f85

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 467443.crdownload

Filesize
24.9MB

MD5
32ddc474dfb04b6d3dc44b86c4b7391c

SHA1
323c3551b229e82edace0c08bc7ab544c0b94cae

SHA256
2e35b7cc85c6e6e13c7fbb1ff0b32823203e481d9bcc94e60d142fbd5408cdc5

SHA512
05c6600e87ffa55b0f988bde5c995714c3783818427051427391358e616dd9582340a959f75abca5a206ffea36f3ce82233e90634360df34912f5632761c5a77

Download Submit