hxxps://drive[.]google[.]com/drive/blockuser?blockerEmail=mpateidl@lockton[.]com&blockeeEmail=iturtiodrug2001@accesstask[.]supporthepask[.]eu&usp=sharing_eib_m

Analysis

max time kernel
202s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2024 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/[email protected]&[email protected]&usp=sharing_eib_m

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
1944	msedge.exe
1944	msedge.exe
1820	identity_helper.exe
1820	identity_helper.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1880	1944	msedge.exe	88
PID 1944 wrote to memory of 1880	1944	msedge.exe	88
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 3248	1944	msedge.exe	91
PID 1944 wrote to memory of 4052	1944	msedge.exe	92
PID 1944 wrote to memory of 4052	1944	msedge.exe	92
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93
PID 1944 wrote to memory of 3140	1944	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/[email protected]&[email protected]&usp=sharing_eib_m
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0a0a46f8,0x7ffc0a0a4708,0x7ffc0a0a4718
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,14855000493053671754,6007420638053900291,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fa070c9c9ab8d902ee4f3342d217275f

SHA1
ac69818312a7eba53586295c5b04eefeb5c73903

SHA256
245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7

SHA512
df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
88f9332de780b8500b6b3b5f8fa1cb5d

SHA1
27609a276feef34fd1cefa230c57157271d874c3

SHA256
8fd250e3382438aee89c2aaacb1af7e98d80d8aac9ef585e1f12b93328a4916d

SHA512
1fea512a2c5cf096335b591dd329d6c7e87bd1ba3ded48c9ff3c2ba34d565e77b6ef9571aa4e641d1ef4773ced9d73597e39fa3eed0880bc6ffda56b0686639f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
80cf7321f1b9e0c43571d5bebe3aa55d

SHA1
e43b781d48c0e44a350c22ac899aa9978a79dc51

SHA256
6c9a8471ce9a84ae53115c858073ad4de437dd57a0c61086aa6251a635ea0093

SHA512
f132494cbfd38bf53db6dd4460e80292369fa073dc7e7049b227f7c115a26106d88b6e0e5f13641e8d69a961d2c811055e1c4ce2ac1e4e19969379643b0357b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cd681916e674c5800cdb1b6e81e83650

SHA1
9c87842e0eaf2f96f7a7bf0b1016dfe64e876e46

SHA256
c919346d17a06c5ceea8722e57ab32ab4caa4f92ab9444df1aaaa8487ee7b972

SHA512
7924401ab782688e159f692def9f8779e4cdf95ecefb8090d0340580e075c1edde0d74b5fc40a0a733aa5468a18e132f0d82ab1e5bd3aa117d4ca7ba5d98f248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35e114a204fd0c98b45b083173d09fc5

SHA1
ec0400abbf09b79353584011f887424de89b9364

SHA256
9ce677804c0b5a069720ce5d2757fb9b917ec7552e74fea94a85c43f41f1acb7

SHA512
34473c43f49e33ea123745773cdb9c36545f6315ba1f54025484c55e423fd2386852e10ba2105168aadf65b6ab837c000790484f812188d62de85a9cb012ce61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b20e14ef4f8ba0e5537286572df9d94e

SHA1
71ad4b63ea066be52b3a7c62cae6c474d768c885

SHA256
42b5cae8f70bdca54c8f8fb47b2be33f851beb96bdf261180acaa428210ab3af

SHA512
2d26b98b5d39eb8bd1e6b055a2d0f95569a4770be1d91693c6cd70c6aa7b8b0497ce9b99737eb235e4b47c0efcb7760ad66e4d53b42e1989691a6dd1fd2111c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03d5a19d636f202e8ca1d9537741583f

SHA1
da6d087185320913b2f69fc364d70799db79a88c

SHA256
451612bef1def6638912c1b2e8e8028a1bb4d1004dde73488dc56b72a1bf3cf2

SHA512
6d027205aed339add66b9cf7823b0d5c467f32c4224729e4aa2721d0d4d888a5fd31d9910be608a0786de1aabfdec4f96b4d656299088d1f963bf90494006505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
917dedf44ae3675e549e7b7ffc2c8ccd

SHA1
b7604eb16f0366e698943afbcf0c070d197271c0

SHA256
9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37

SHA512
9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
7fa41b0a804d109f58ec4b22fff46456

SHA1
2c60908fcbb9f242f17c7faba9a32b3cb6effbd3

SHA256
b158e7cd072da76c2135333915fd7d3c22a98ecad9fd439cec61678d1f4417f3

SHA512
b9520c2fe1f28c65f0d721ec5fa5402b5f5208f40da3c2da913070d569c7a16b7ceac2bea111075f3f8b41b9717056511df9152f0ca1cd11dade1ca5bcb33e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
2bcfce5c212c963b5dcfdbe51b2fe6bd

SHA1
041d2a09f2d5c7d833843125b9283ba651338851

SHA256
2054dd49f83a28c8d8ced282612b45b0ccd305546c946b8b7ad6e0b49eca9312

SHA512
45976c9a84e0a6d784cb9dc17cdbc76fcc663082538f6ff5fb9b836fe4d087a967721b81d47f9bb8b1379aef7e962b67595d7edbfa707b6adab6ff89384a6650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe596102.TMP

Filesize
370B

MD5
fbf6ca93ea5e8425cdac58c7e93e841d

SHA1
90f21b8b518795c1e90cbe756cf66964d3008778

SHA256
5cb4107d2fba213363547e3d7f14cf95c278ff2e75f4236da43da6e829d43cc0

SHA512
7327999d75fa01c5d9478ba7abfba5e823a2905b56e58b47dc48ff08bc24f3b4d3ba101e49f2da402b587c315297e4de665d326790cf4a69c2933b0ed7efaf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a691493d58d5993fdf419b2b060a60c

SHA1
b174ce146240f1caef3a6d1629bef5c431869159

SHA256
abbc239dacdc4d409ecd72d79ce7f00933b30fbdbeca4fdc93cbd1d807396037

SHA512
40c314a2a47a9f5b3fcd1afc63fd3c1316ba88a28abbc6e9ac81fce53ce5a313714db1386b8962c32767599fba7449ac1533f92d545d84f5aeaa650d5c0aaffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
af7815b47757639de6a4aac24ffaebf8

SHA1
5d701289e9b22103fcbd0dc28a2ecd9dfdb5c3ab

SHA256
064a5bf90263299e9afd32c9bef490687a1bbe7aca4021e3bcde672a0a716514

SHA512
515936214e02a9562f0f6c0467ec5d508a58229844cd318703a0f5f516f01de18aeb791450dbbb7044da6af80799cc78b71d1a6cba9c53089d9c87e5dec423f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
52742bf26e66283168bbb2110183fd1f

SHA1
119d1246358e65f77baad9766089f778c58355a2

SHA256
b5b545c56e18d68b17c6609d18e3804d1f4b709a8a71057aedfbbb924c90c4be

SHA512
0088091abf6149ef6c4b77952db91912f1a9f31f60702c6e63974c7c304fcc3da79d11fe21ffd2916645d37c592ecdc16d5a90a2dc806e475330fad11f109c0c

Download Submit