hxxps://drive[.]google[.]com/drive/folders/1Fs1egwsl8c8PdRNSGzDWY3B6Swjz2u8B

Resubmissions

25/12/2024, 06:43

241225-hg9mqazrgj 6

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
25/12/2024, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1Fs1egwsl8c8PdRNSGzDWY3B6Swjz2u8B

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
3	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\EditingPack-20241225T064406Z-001.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3484	msedge.exe
3484	msedge.exe
5040	identity_helper.exe
5040	identity_helper.exe
1892	msedge.exe
1892	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
2032	msedge.exe
2032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3648	3484	msedge.exe	77
PID 3484 wrote to memory of 3648	3484	msedge.exe	77
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3628	3484	msedge.exe	78
PID 3484 wrote to memory of 3184	3484	msedge.exe	79
PID 3484 wrote to memory of 3184	3484	msedge.exe	79
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80
PID 3484 wrote to memory of 2628	3484	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1Fs1egwsl8c8PdRNSGzDWY3B6Swjz2u8B
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9a8e43cb8,0x7ff9a8e43cc8,0x7ff9a8e43cd8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6580 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,4480171084750255460,13948966490285343607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8467125c-6887-4128-aaaa-7f1bc934d7d6.tmp

Filesize
1KB

MD5
5251ea6e85b95712ce2b889cb980f77d

SHA1
2d19cb2f61c1d7b18adccce67d4fc1b59c79037b

SHA256
5c03f2e5318a3be33b64c1a5f548b01a7d79054389211c9c9111310356cb4297

SHA512
5363cee110a62d0270120c605f94a9add369cc4407db105732e9682bdbd69c91aafbc5a36f4b07909355ddff4fb083425770317c0a5ec99e8020d6c893b43a9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a89dc98c8bbcc955d32dc9e8b291c67a

SHA1
81c8d2f12ace0d1cf12a97da95d7d51262b4c133

SHA256
123241432e219ef275042f2e6bcd2a10ee8dfb40c72f1005e3c021d80dfd1c3e

SHA512
e0f7d2e8ece105566dc31c1fded6ff4893b14110c87f7ae70dbd77cb59db4a95ec508dc45df0d31d39c7155f9dcdf4a20ccfc6517ef47f090feb66d0183d4c9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
85fb3925183282360f7b11753284c8d4

SHA1
44fb2e9cd85195c524ec458063399f6df4515dcd

SHA256
36f72155330c36306183f84a97ebc395404bcdfd6fbdb9e1c721b01ca226b7b3

SHA512
635f5e63d827fc744469a0cb2342c051f42a8ecba702a687b878e503b32c62a589643dec770e736261d03984676a0a9209a4779cc82629232c9694fa3e8b72d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36ba9d7796e3b40e36acd773e4800df1

SHA1
58d0db4825ee8696b995b0e32310cd79345f501e

SHA256
75ed6e9a0b2676c35ca1f02a7a007ebad833dd91b28a2b48642b87d1bcbbe818

SHA512
6b77a4776c59697929a315f990bd7282740c7fc36c4ec5c2d0746f32eea45dea6764146e66d422eef02c60137da5e5dd3247632d57c736874babdf0ea9b25f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eee05051469aa42b45800f1559b2de80

SHA1
004a95cd5a54e698a7031c73f347e2948afcca42

SHA256
cef2fd3497a8c09b2103c8e354e2d4e4c1f9405c4df84acd072bce726fd23e45

SHA512
56888d6493c4c6e44f33f1f7cf24990efef8ed33f49aa0b6ab5ba05f6c212954f51013e891caf56904ddd971af6b311ca9b5166e54d78582ce34c41351d3509e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5fc4992484bd87589ff37c045bebda37

SHA1
d480be164ac69f12e24129f304c13fec681f663a

SHA256
7eba453c6efd8abc2a7eb153deac1e323f6ce96a1b46b60e885bb44596c64515

SHA512
5a857b216fad91c45a00554233a5b904b3ef1717a4009629e1bdb00c8faac4fcbf52b19060e8814eae86341c479af268e21d4dc0309567f54984d81c45672daf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa16876072616a6630f8cf25b97760b1

SHA1
a451531d23e0544d26db844402987fe9dc9df35a

SHA256
b6238f6787970ccc4231fe58c911fb1d75f6d54186706ef696524378ff828750

SHA512
7cd146766d53630bfdb40bb5b0cad615b6f8fb9aaaa2bca517da408862a6d832286767a71874822149c8ae9133f712ddb4bc40be14906c7211885ba4519c1d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
e6d47474d5ef1b3062ae0e1b7856fb55

SHA1
cc7f612c795f8d179ade3fdb21fd48d2de773374

SHA256
31fee251a1fd314def5bcea932d1ba416c585511cfae7737aac2a8f558634526

SHA512
4390ecee317733841523bcd12f08efbc3c9f7b3683790345885d0c66428069f2da7a44e040b18a74090a041e48e6bda1102ff605a0f8665d58d4b21441562288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e119.TMP

Filesize
48B

MD5
5ebb3e48d31e7dfc522343302ef0ebda

SHA1
4c1553f24f5b769c950d57416b84202014db9854

SHA256
27524a39384afb547fd398a7a3043f13d95c96360d294e74555dce23b6f8ff99

SHA512
f4c440a8ff04836b687340f4d79768115d7c546c5fd267da0c2d4eeb00e88995dbce1e41614981ab8e9b85568e35b4aa45a147afe3b07168f8a973995c3674ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a54e87ad8abf3c24780fe084735ba880

SHA1
3f4af7f48ad8effd2dff488a46649b74f290056f

SHA256
a76f9016555f11a34558d2cc42c790ae716b02d05a648ca7f4a3d2edb48db172

SHA512
ee5c5fe2c60a6a0dfef2bf96f2c86683fe1818a4a20a173d01e1cfdb28f7ab37e4d7fbfabc0ae5b0dba1dd9922aa2296e7ffe4eec0f47879eb5c6d09b5ec73f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
09ddd220fe5200b9d0326b6678a9d805

SHA1
d2b40b70a955a37d1bbac7de9f39eb60b66d98b3

SHA256
cfd2f70cbefe7357807edd97e06ed400f538fe9d56055c58161fbdb6d918b2f8

SHA512
8e2f3e80f90283f3dc8d10513988f50a58248327f0cbda78096989958c910318269153622e70f314dcdcad52ddd02e83e49958285f16e02c3c4a6a0a825339b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fb173bb51d1a37b1315095be0f7dbd29

SHA1
6a8fbc355142897dba89d166e686052ace75e634

SHA256
16ee57ab604cb179591f45a8bb6f76e7a50dcce6f59d2341284694b571972a06

SHA512
ff4bf9690172face119e3af01899e83e239af302364f8b4fafe77791870d835210b27ee7cd181dc37d3b074b15c9ec7641aeca485360c0766637eef0a04bf45d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c2af8d1b054fba84a2a4dd94d6172a2d

SHA1
5e32d4ecc840cf252e65bf723a3ab7f430254a5d

SHA256
e31ba75004905b08c4bd0b25b14638c751c43ec01a6ed5b6105e76297fe7f6b8

SHA512
c8adde994e2946d9883e9f229c86d088932189cb71336bf0f00480390407369c2e2252516025f9295519f02fb02f6a1c3f4f6d20233394a1b3add7df2a548434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
20a8e7244a54f66c48f750e7f8afb8fa

SHA1
55546ba57341684ef50bbad56524cb462ab0f076

SHA256
c44a1fb2933988aac28a33136192370769e467a4222beee357ad52c156d961b5

SHA512
7cdc5376846f945bf0b9d22679b8c67824d77ededa23a451180f78961c073cc59d3df766f2e3890fa9bdc3e34eb6d91872e05546ed8e88cfeed2b72b3fc2c7de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ca64.TMP

Filesize
1KB

MD5
2f69155b1edb4719c9debbb3f2c29d3c

SHA1
cfebba9eb63940e0ff88e92729fead6943858324

SHA256
b1f72102d20d93dbb123f62d8b1e4d7895450cfdacf58a0a88090c10e57ac25a

SHA512
95cea68e7d402d3fc26300e310c8cacb7099423bd503c7fd1dcd7ae3ab782920bf9b81c6210642a5a2986a777122f9843c24b4082154bce518454f36dfa5f213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e54825ec762c185d80cf2115290425bf

SHA1
7126ad412ae2563808d826759fff82ce1ac7f4a5

SHA256
92974f7a2cfb4e723545c6a0d63e678b9f0cd22c9a99d9306ebc8762b8beec2a

SHA512
51391f82a26197c8373a11ebf1daf6cf9e3df8e8d57373eb80a532ae0332b657fcd4b3849ceab14053ee610598c190751a61cbaadd94b5521b55dd81d2faf7c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
abc587ac1bb82059a7250b7ad2479ca6

SHA1
9ac3ad3e7b8d377cd53677a7e4697ab6c0765710

SHA256
74d91ae86bf98ac189bc0d2dfd791ca0d7776107f8246efd2d16d5038820818e

SHA512
f6ca54f1e551e960447753849549f7f113d6ed3bf7ab820d80d92d6bfdb097a8e1bfc92c39bcfd85f27f3fa765c9aa19713f2ad7bfa3af65d45488aa9220d5e4

Download Submit
C:\Users\Admin\Downloads\EditingPack-20241225T064406Z-001.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit