hxxps://drive[.]google[.]com/drive/folders/1XYW6m3LATzVDJYm473Gr9qJQXAJHTfkE

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2025 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1XYW6m3LATzVDJYm473Gr9qJQXAJHTfkE

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
9	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2144	msedge.exe
2144	msedge.exe
3452	identity_helper.exe
3452	identity_helper.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2248	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2248	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2864	2144	msedge.exe	81
PID 2144 wrote to memory of 2864	2144	msedge.exe	81
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 3612	2144	msedge.exe	82
PID 2144 wrote to memory of 2240	2144	msedge.exe	83
PID 2144 wrote to memory of 2240	2144	msedge.exe	83
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84
PID 2144 wrote to memory of 2264	2144	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1XYW6m3LATzVDJYm473Gr9qJQXAJHTfkE
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86db546f8,0x7ff86db54708,0x7ff86db54718
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6456858957448852065,17696653370481240012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x384 0x41c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
215KB

MD5
d474ec7f8d58a66420b6daa0893a4874

SHA1
4314642571493ba983748556d0e76ec6704da211

SHA256
553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69

SHA512
344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
32KB

MD5
e0536da7556991ea99d64e645cee9489

SHA1
b9a9f2efcff0aa2d0f1aed4eacd533590415d12f

SHA256
5c55c2ea75d6df79e1597010b13043cd0bd39b02289e5413c0182bc9bc20e561

SHA512
62761a11eeedfb4780b5c643dbc248c633b41d3046b9fbb5a3d2f8c89cc8ee0b12dde7ef7f78402aeeb3d59f6df71476b132e766aea5859daaf26f79d77c1b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
be22bea9d7b06212aa7c8bf158d82983

SHA1
6861cb785af5214a1ceb0cf16de49471ce2e7893

SHA256
722aa5899143567782888d51898eeec961a7c086211e8672613f6b493482871d

SHA512
1e6e452ecc947a60fd3b37d3525423d1cfdf7fd85839b76d24d6ead74d22a8f198284ea5e4b3e69a7a8689431866dda732c0c91d06567d860992e45570efe5b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7e5d90773a0bba5de224eb3333276278

SHA1
2ce94a4c2a287d64755e2dee40676ccc1881a459

SHA256
00b0f939c0d09935f25fa4e5c7a750e0da571dfbc55fa8f56944d56186518615

SHA512
41c25097b7964a92e2b9f9ce7f8d59ec9f46b14e7105d43341b5143647386b11c1e78d69509d1b0cf8fcdc14a89adc98ed141a947e978b2e6feb09b1fe99db2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2769fd402b72a3c641aed582522340a2

SHA1
7ac679992d71ccfb705104a9cb4d055095ef871d

SHA256
fde07540526dc3412b58b0a534510edab84d5a16943d3bec7bc6be5bf772e8ff

SHA512
b3a7962613274639ed10174c1dd0c6ad21b8212f14e8af2cd49dd0986022a38feab4360395c1f83f58682ec8e01763325b367588111ce7a87890495b7f563c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b3d5e84f96aad0e3472cdec338f6757

SHA1
70d84155be99943fc5ede1296156fe5767e79458

SHA256
85713f7c4b9dca005f871f9d978193f068f6efd5602a3933ab892ddf1d2fa0c2

SHA512
5b01f48e606010dfcedc1252ca6d9c511995196d9ad4edb2fae98930f4eea75771e42767597228a50f650d22a458732c8bf07bdff50791249a0f7587a28f5037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b027ab109feb50f809c77bf28e89e0fc

SHA1
4640fd5352cc52ce6e9b03927fbbcbd7a6130498

SHA256
b81f596a26a708b84a88ff07004214ab18965d80749943f9b901d4f54523255e

SHA512
50351992f8cdbc258cf06f708bdee6f9644da172198f01d1605105284685553d1cd9e290dcf17b86687ad3b68a0ebf59358835fd133aa18f0be9e248a04eef6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

Filesize
97B

MD5
097f89f2058c8d2019c22bd4ce5076dd

SHA1
cea2c68c6bc7ca1e35956ee4a459d88d821380ea

SHA256
880938c3c528b40062578f668909ba55a72acc2b24e76bd8bb32131fd5bf943b

SHA512
8fd75ddeb217d7dbad340383c6310e7e5d0b9a97067cb2db853001f8f555062fc84eed5d932c0756bc8fe0e1dd81d158c054c5524308908229722ae5f46cad03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0f4c87f58e3554965c14e5072f508889705a6c84\index.txt

Filesize
33B

MD5
b0195b619cd45d0f8af48fc59c3d7716

SHA1
d153ae8be73da841309a68f26d26642d05ac20cc

SHA256
37bb3e6cd75d830156a6934fa1d1516121b37b4a220705fe32adece7b7ed927e

SHA512
6d917a97131baa380386bcf2c83dffb97f832e85f9510db3df4f7cdcc35396da58e5e098fbcf3fa7867b7909c09158d091ac0432919ca685ca5c7966b88a23c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
66d5af8344c83fadfe14d17f73c8c8ee

SHA1
7cb5cde269dd735a89e037b77dbc507ec4333ace

SHA256
1606340bf6405c391c592b205374c54766df48a4f83f499795a1228a65d8bc57

SHA512
215ebb28675d4b6d6990f864d28a9305ab762436697cf999097da058d8fb815a26b31fe11abe6ce43dfd3566cf67d3290aa64be54324bfba06889dfb602fea50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58baee.TMP

Filesize
1KB

MD5
965820256bba08e5d050825414c05c5d

SHA1
227f9be0fbc6b431c93af8d5e365bcca36701783

SHA256
4123b1f0f886ec50aa663fdf9ad6a74f85af9824a61bf7964f9f62dca60ec655

SHA512
fc2db6e48aa76ad15933502088f038814e45e2fb106dd6cdd0741830982ed476a828639d2502a517414616b68fe7e68d020c6601d7a762c93cbe22df3ec95514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
91286f989e1093c5a783d72e0c0495f4

SHA1
47adc7e4fcfbbd5aecad1df500b7826915542e7a

SHA256
9157cc77fa40f0f5aaeb51ebb00e4e2c108426c791252ca69072afe7b676f853

SHA512
b35b81c8853512ce68a3f91f632115967a8e747b67f1810b07840b188c4b561783e4f7b9c293d0914e13dc7b379789613174a4b23e41b43fef20cd5dbf598db5

Download Submit