hxxps://drive[.]google[.]com/drive/folders/1cpRSYghWt_Ehgn-YEaSMlf38zvMZDf2d

Analysis

max time kernel
99s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2025, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1cpRSYghWt_Ehgn-YEaSMlf38zvMZDf2d

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
6	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
60	msedge.exe
60	msedge.exe
2960	identity_helper.exe
2960	identity_helper.exe
3020	msedge.exe
3020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 1664	60	msedge.exe	84
PID 60 wrote to memory of 1664	60	msedge.exe	84
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4472	60	msedge.exe	85
PID 60 wrote to memory of 4980	60	msedge.exe	86
PID 60 wrote to memory of 4980	60	msedge.exe	86
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87
PID 60 wrote to memory of 3636	60	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1cpRSYghWt_Ehgn-YEaSMlf38zvMZDf2d
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1cb346f8,0x7ffe1cb34708,0x7ffe1cb34718
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1940 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1200 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,2579725933183444917,9697975901894133436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:1724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6a53cceb7a396402c1eccd08dbe38a73

SHA1
96e06029b79791df1b1a0a7cef7508a5c44d13c4

SHA256
31c8ba2ce8a088515e4feff78968e8916c759331b7428421a990cc349a208b51

SHA512
bda381d092d0272a19350a66533ec0fac2efccfd26fc87695a8270eb3d4abec01483b31dfae75ba3f128623454d471c9e948c44df478edbdb6b5a15377637036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a451e41e51facc395053e7b74c3490d0

SHA1
c866ac24af529f0265e99bd88529da46c9ff6dcc

SHA256
cc33bfdf9c856a2e9e9aa8eeddf9723a0396fad82b0dcae7a408bb4c84fdb584

SHA512
553489450d55d7adb9c859e521d0e46961490e54c533c826adc8c546ca0b51ecda82c159801bd060a291e724355c6d4fd2ee603ff65d4a15603f34f1472664fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b86b595-1537-42a8-8445-6cf44089f498.tmp

Filesize
1KB

MD5
18cd655217e91d0dd1f449e957937370

SHA1
04a09b8afbdae23c3d98832985dfb0e134e5cdda

SHA256
3157ef2615793cca9c2def537730ababf8730e806ca2003a23c11f14bc6c7bf4

SHA512
301ce7a707bd2c08bdd8a7b79b13a2832bce767dee0908a0d41568ceb088b19ea497fee9f042b20bebc096b65720862fdd03ebea7aaf2d94cb80faf2eec1a6bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
214KB

MD5
ba958dfa97ba4abe328dce19c50cd19c

SHA1
122405a9536dd824adcc446c3f0f3a971c94f1b1

SHA256
3124365e9e20791892ee21f47763d3df116763da0270796ca42fd63ecc23c607

SHA512
aad22e93babe3255a7e78d9a9e24c1cda167d449e5383bb740125445e7c7ddd8df53a0e53705f4262a49a307dc54ceb40c66bab61bec206fbe59918110af70bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
24KB

MD5
2b77b2c0394bfd2a458452006e617f96

SHA1
11eff89a8e3e64401818f81a02bdc84e8ecc4325

SHA256
c46f001852fd8e16bb731f21cadcfa0cda8e7d064e11b0faa18d6bb8325acb1f

SHA512
21dd89b9d6874539477e8b8dc8d98877c86595a8b0b8deb624547c3f407fb41550f65ff744c22f25c574994414a28e73f4d0794c5bd49be890fdac7906f0ba30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0f851e9aa624900fbdd12cef541f03d8

SHA1
e9e11754df896b264c99d0b112642fd755f0ef87

SHA256
a18c2e921c7b770fbd906855f7da68350856b408d15b4454a9e545026973c2c6

SHA512
ddf216627b34df8e899633ed6ebd2d279c854690b5c8ea3b57cdbbd98532eaadb011f0e9dc461b02075fcbec2e8787c39dd581cf1ceaf6da3ea9da2a91be80ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
460f516bcc75ba1ad76f5e7f1cf8eceb

SHA1
90b11675928b36595a679169c2c1a8c1f9769624

SHA256
789248d73fcdada602e5296a574c6541f6df1e126403250a8c4d972b64cfdabd

SHA512
b4e6ec34cf1f07e035704d47fab85b85039e369136999f904423da0e5034b77828961ade3d455b2958c9122477b9d6d12a1075e2d774d3f123b13fc6623b4331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2d626e41fa1d7a98c74794b61ed4106e

SHA1
536b34eff5006304203062ddd9ca58105f21006a

SHA256
9aa2cfa2a18626b3cdb508f97cd8419707a8d42146fcbe238c8d9e89a6755dd1

SHA512
bde29a1122b377a7b1a2833c7d42194980c19f365059257606d97e9795a871ccf5182c270d7713bfb2cd2c108b310d3484115dd73096e624c8ba6fed17d259a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
36432443af78fee9fecc3daf3a43bcee

SHA1
7cbe98c932ff81ba73bf6c79ab51fc2cc96550fa

SHA256
8169e614b9435b79e58a2e5feb2cc508ba21da8c228eb12e4d3d9dfbe7ad465c

SHA512
ff4477678ad9a0ecd152cf45fbdb6328ac0ed62ce0b8305a4f0a13ab328083d2639faadb774dfd012544d4c976a1f3cffa6ff363448b69dfc12ba37b498217c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26b1cd9ea8ba197185d1c34e31e6449f

SHA1
7289f7646327f99530a8b7dfcfd5b6cd35f29c51

SHA256
96d2c5becbccd2bcd4bded68b327b826c0134b037ecb897f7a1c9c146ea6c194

SHA512
f60bcdb86ad232d59912e83ea8e42a8bc840f27288dd561c43673efa11f29b0ecd96cfa186d31f2b3b8ad0bbc4303b760d1bff9c8253ac97d03b3071f4eb6d6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
46b32dc0510a57cc21f18968c989c59f

SHA1
e6bbaca1b7a42c85b2f4c54734adbc4c7256aadd

SHA256
70b4dfa87c2213812ce856acf1f28436396ae88cff8ee7d124836623875b78ff

SHA512
f95c36ee1287f00bec41a2cec0650938a775db30455af17d3b95023fb9386b1a5406703152dc72054cac3ef4dfeda2963d5dd5fa28dfc5470f5f2df7530301f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f63114937637b36b96f97977abb31306

SHA1
03e2031746976e5785912c144ed9665e68c4b665

SHA256
10eb5e6d383d0f7846c257bf82d0c7d6551be9eba0d2e9c09d94e46afb974f96

SHA512
e737e60154d17eca8455b37d6cc77855a1cef08487eb3934f06696c371a35ece7cdd04f51aae196c002bb8655035cb7e019c82d2df799594835681c4fbbcdd9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98611c44d0700bcab29fd36588557e7d

SHA1
0767836ffc5f1c613c7c944aa0214dc3e8e19bce

SHA256
288b660686c3ab9c10b2f18a86c55e39d308d96fdefa75e0e8a96f842e1b2aeb

SHA512
322f96d6b5b5f1992886997b18ba46952f85993a292c80551bf7f678eda99325f86e384a9867c652359bf969159515b953055d2442302212d0e8655aab3740a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
67590824699e44c15fe3839ff6e27706

SHA1
3cae83fc07fea2c77dffdd778507d2ba57064c22

SHA256
f1d0ed93f66b4c9267fef7c90a6cb62f036cdbe7cf732110eb8e59f74b28570b

SHA512
eb6ad9f36f7026b7289812fcb84f948cebfec76cc32aad5acafa9873f32a3f59c4dd5c94eca99d1e138c5d038a338bea836e67bec1fd0696f547bd19af5d6c27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
237076a908a09f57826706af74261d60

SHA1
fb027a8e5a6d50c6bd59ae0e44bce23ee2bc3736

SHA256
4978303c5795c1199bf6b369dadb47b23ef80221957ffacbed2a27ca22bfbeaa

SHA512
9f5e4fd5a5850cfc22227f7ee955cce8c6174979d07902ae83ca8294aa26c75c0e1de6a89f798acf213212ed6dfde76db5ba306d75bdf78a07cb07bc4f4d4894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5888e2.TMP

Filesize
1KB

MD5
7b734bbc066b549b3eba5baf0554dd48

SHA1
f59d49eef3be3423570eec2ec933af3dc0cc5460

SHA256
d01ace0ee23d66babd8c59a5a1e25784a509493478e260475f82395ecbe781f3

SHA512
fc0aef1a9b70616c275ab6a403a981cfc525e0559b5c14b349a134e417dd0c2f32631051e7c09ed7a63a0d4a6e71ebf1f0d81a4b61cc9326078993f3d7403eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d295dd17046ebbe8359f4912b2a59de8

SHA1
0bdf4ca14f680b3e4462af2847d98ac8a3960eb3

SHA256
aa3680c4a5fbd14622d81288539cb1b8c463bd3c2e5fa4f2080835cc31ab7867

SHA512
0ef162059591b0696e2742d777ddb749bd03d9fd2812e7bd672efb0ede6b094c28068ecf45066d256069c2ecc7a556e6b67338b1aa7afa02559eb68c18fb25c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
01054bae718601bf2810405e40521b2a

SHA1
45cbf3ca4ab0fd3a3e2bd67b1702283d4031c4b8

SHA256
ea11826349a5b0fedca64b908bd80f313bbdd13c0c46ff205ea9e8c968541207

SHA512
4824b217e15658a30be7d00f0cc4556545a44460e32efb13e4f4e529954503d98173b25b150045f86e0ab15a9dbe86f3bc5d16df9130e3b407d1c9c7b5d93b34

Download Submit