hxxps://drive[.]google[.]com/file/d/1RDeGwJy12IQRaim9yNVXNPcszpQPZTYG/view?usp=sharing

Resubmissions

29-01-2025 10:17

250129-mbhz2asrfm 6

29-01-2025 09:49

250129-ltm62asnap 6

29-01-2025 09:31

250129-lhdhfstqgy 6

Analysis

max time kernel
131s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2025 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1RDeGwJy12IQRaim9yNVXNPcszpQPZTYG/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
10	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
1596	msedge.exe
1596	msedge.exe
748	identity_helper.exe
748	identity_helper.exe
4460	msedge.exe
4460	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 3564	1596	msedge.exe	83
PID 1596 wrote to memory of 3564	1596	msedge.exe	83
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 5060	1596	msedge.exe	85
PID 1596 wrote to memory of 3676	1596	msedge.exe	86
PID 1596 wrote to memory of 3676	1596	msedge.exe	86
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87
PID 1596 wrote to memory of 4592	1596	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1RDeGwJy12IQRaim9yNVXNPcszpQPZTYG/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd426a46f8,0x7ffd426a4708,0x7ffd426a4718
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=212 /prefetch:6
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,17604590951548559891,12093800616890188192,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
b71c68ae45756cdcbd0345604eda14c0

SHA1
8c78fd459518f579ff0f4270d6b7c3adfe475451

SHA256
163073f5589b277e0bbb8e78126a59f32626a5f79c3c20c5d6c484734f0ce021

SHA512
2d26c13f1a82ba4184d5647224c35c5466a639b528b94db6a87e34e8c248848192f02dc6e611437a2af759489e3bb5298ae4a9d0fb6973421c311fdb54b89a68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
91023e32416dae307de55e86e7c4bb1e

SHA1
16e2b406684727701369dff13107b7a7e126de54

SHA256
ff9eb7aaf552263e87a1efd237ceaa6e20cb7a9a231a1f240473f4850e76fc02

SHA512
a3ae1deb0259e177eff2c79e24f6bb11dfe99ff2ce84720f53ef51340dbeaeef5b9d061405f06db1ac6c789fdce8dc451bc511a8ded3dd593a9871c10e61c300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7717296303fc9f99bf630c1ef5167164

SHA1
3e01f6fd6c1311dc3584d7d86408d0c2839e6bf4

SHA256
04899a24af57e4a28a4eb32c8c64a002cbfda0266cf369e90b0f6a85ae5ef0d9

SHA512
09efd301a384bd5b092a49f29f85a3ad19579b32e7fe92bbb858ee88e59b46348f393cabce40c23f8ef84d4d0e16a2a0959ec6f01ed5843667ea8bd89b9949bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5e70e1024453103b5c35192dc306c31

SHA1
5761cdb2cd6eac8b2770dc738efd14878ca69128

SHA256
a5657fd868292da06c81e358eb9d99d357d7212d5c77fe018979ab47b64be2e9

SHA512
f57b699e526e57e786e5a1d678e4052f1159d294e10e5c6aa938aa4d44431c04f1f8941a1adad89327e128bb1884a322e6b4914c4baf386bf9b8a8e1962ad05c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
027897b9850e7789ac5a7ed1d3bd5963

SHA1
ff84288cd7cc49a440dd8be991babd15b4dc18fc

SHA256
c35f45b6ff6e34afffd6415e58bd06c596c6c59a6a454ad3de35fb557f319ddf

SHA512
a1710b64cc589ce3b3cc4b6defbfc8fc336f17195e35f78a750e0323c307cfc605198487d5a30d393092b42968f9113ef0b5d58eb52fdcc26faff44f0b2a5992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a1d7e5e45597c94ded9c3d7be5d11e54

SHA1
c078f4f282021d11fa660fd6e98210765b13116a

SHA256
a3ecb835ba580ef35329d36063d1decb1674662729e8b9a939ba5460d41aeffc

SHA512
59c8de8df5bae45abba3f0254b28ec6e293cdea8aa7856093ce054e43f28829820b177a730b091f43e8af3c796eb496ab73362faca4a4959856445a3db700de6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
42fc1e647bb080935dd7bd1889a6becb

SHA1
4d60c6cc9739d090344245824f8a39db800e4922

SHA256
9b62db067116989d32b7111a0a7152407fb7edde9224a1fde91864204388ccbe

SHA512
166a1cf5b5bf947d5e9e4f65ab29e60640da52d2c35f0b8c0a0325f53680aa2bd38b1b13c9c840d3e691e8355924bda8888e582f88ea132b915a0102e6b44b86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f37bf53cad699571f82b7302d46a8eb3

SHA1
5af648437c444db8b312ee85a0b5c417611f6997

SHA256
4025884013836c5a8707b4860231e0094817a62325d81e5ba2a04eef4afa6e30

SHA512
a464481eeeb0d7421e261da3fa406365352aedf6aa3a19984b72474cbe53c6ffbb007fa4a9f78dc5d0306a7b2a058e21318e80e5a0dc811a0080c8a914887e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98ffa936b96dd5319cb54af16563433a

SHA1
2c79a79180412cc02663addd68fa825fe4ba9bf0

SHA256
1058f45f3896a64b2c2698c6cda79830e44babfbdc1565ef38de1cfbcf9e89fd

SHA512
a2d70c894aad7fc084bb796b20bc37ffdf406ba424f37425526371166f63e8ff6d7fcc61599b8ea329da2df08b68b10c89ce44a74d87d0ee5a5175bdfd45f8bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c6b996f9e857c28c7e31b254af4df5a7

SHA1
79daa9d3755397006d0ef6fe13908b9f4583fbac

SHA256
7dc897daffc2a1098c0a7b84225e6175cd107ef6dbe0d2647c84b863cfb3a1d3

SHA512
e40a2886d08b692fd023143c43232331e70367e342af4a4dc19d1831ab50ce0d5dd3160d84a008dd9aa2f1bb7f6dcc755b096064e922f402a65b65f4deab9e3c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 909631.crdownload

Filesize
105KB

MD5
58993efd691b6d56a186ff2c098d9f6b

SHA1
7d5f59faacb290a4b9150f1877c9adc0d0817813

SHA256
0612acfecf2b1226289384e3036f62d18f9aaaf168ac783f0b3e20b076d4d321

SHA512
07ab61580c475e488d980699b4eb12904db76891ddd9ed79280a0e10362652f355256dfd483ddf0680699ce63901579e0da47abeebeb6fdb3699176272c16a31

Download Submit