hxxps://drive[.]google[.]com/drive/folders/14vqCtbwG3dIbDlIeCSE_y1nfpEzFNrxB

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/14vqCtbwG3dIbDlIeCSE_y1nfpEzFNrxB

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
9	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4784	msedge.exe
4784	msedge.exe
4948	identity_helper.exe
4948	identity_helper.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4128	4784	msedge.exe	83
PID 4784 wrote to memory of 4128	4784	msedge.exe	83
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4896	4784	msedge.exe	84
PID 4784 wrote to memory of 4676	4784	msedge.exe	85
PID 4784 wrote to memory of 4676	4784	msedge.exe	85
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86
PID 4784 wrote to memory of 1344	4784	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/14vqCtbwG3dIbDlIeCSE_y1nfpEzFNrxB
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff983bf46f8,0x7ff983bf4708,0x7ff983bf4718
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4729776396454353393,5303018268215421160,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
27KB

MD5
ce0b8d11a00256be872539d386e3f8e5

SHA1
64658a28b3b3a52c5332c9e1fdb8875411a4f9d2

SHA256
3a009c2e78435c0b5f5454d3a39090a76111f8dcdb35ae665332afacb6f2d83e

SHA512
06fd4d8b19f485e8fafabaebef5f48217d86ff8d59a1889e3a47bc28eaafb23892fe0f85d4e2165cdfbe70761fc006c0650e7304b2534960ee8962fdcef8cb4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
71fe3100e5b0ca4e07251a5403753377

SHA1
aa9a5c8314fea1e90f2b199659cc24f380691918

SHA256
efa1498c2375e41a731a631312eba5d5367b355c20773ae6e94d975034a04bb0

SHA512
8997c6159316b72c31c3537deb4cc7cd68d25e2dd45472a79562729a855bc2025d3b1802987e63738d069948b1c6db8c8d9144a9c5fc34137221fd03bcdc5604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
dfce4fada4b57920d684aeb83f06f82e

SHA1
5e9b804acd1cc442f402ec1d25042a31ab011067

SHA256
17bf611e00b8d52fcb84184b7a74677ce77d6b402cea0c9aeafcd1c9e652af95

SHA512
d7d003b3beee04dca76f1645bbab53932fcfbc4c99ac94f63f28235979df6f22135a20d97b2d232a660e464ed05c39c62d6f7a2b4b1de49e4b1f7de60fe7227b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
9e55c9a2e3956b697f448f343a5fc659

SHA1
b75a238ee5698105f6423a0b74b743000e3ca688

SHA256
0c9af81af02dc0cdf4cf2fe7dc8fb14ad6b8f9da171107b3ae3d1d436a9aa868

SHA512
0f734c319c1f6a61639ea97134945b247f27425f1aa7bf804e3ef331e5232874dbd0e4a7f798dd9fbe03b5b38e02bfd3e90c5e2a1ca436c9d42a9f7d84c522e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
be66e446e336febd743e7b8c008d1298

SHA1
01365e2b924ca312892ea8ae3df2740f59e11e97

SHA256
3a1e12748d7252d3548c7d3627318982343668ce6647acedce4ba2335ee6d0d4

SHA512
1b0bce6fff0bb8a78deb87c12f136190dce40c1e2de02eed8ec8ea66d40e3c5f1ef6279a90e3080e7a36f011cb66965b4b22390f32b40efa2b273d2f8ccfd76f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a22e652542ade34a6c0a4ab81276f283

SHA1
dbca37fe364a28a9495c0dad029c3bfbe9dc8c64

SHA256
f0c81656729a63019c414f2295ec29633b4309c805a05226c6b4dd469d147cbb

SHA512
1c37ec12d64a0450760c5e3407d51d7dfe62d1b174357c30cc07ce367b6c445093060d212583417fb58f0bb5785e60a579fb5c9e5682445e2bcabbdb4ea7ac37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8245564d616335f858fdc5d55c44fdf

SHA1
ca718aeac61a76deafa7a8705b1d955c9a3390f4

SHA256
495f6d27957be271228c061990c421b8eb2b83c7b52723faf009505f5768285a

SHA512
81e7f00d3b38c2b29af479c53898f6c04677d99d5b67bb03409cfe1c4a5e28a6011b901014e3b330e93342da8665a6c82ff18de9c87d8714817ed6c7fe78d7ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
593d94e909a1de9a248ca9e0994ed21c

SHA1
7c5f83fb2f95a5a667188ebc4b494d6bd90da14a

SHA256
f2c43e918555d4b8d6663a5aaafd1316267812297b59b40985d77cd23c686c8e

SHA512
4479e603cf0a8c93fff60cac6e7939c74211625cd6aec23112450d0b3b9dc683d5b123fb7234593522556c42b12549bbd09ab0e75c195dc2cc5c2db89b7e6490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca9555096fec398a2efeb1e5e539b0bc

SHA1
a0011a6071ca366d0832f190025d4c7796429d62

SHA256
b1e2a5db189bdde46ce9bbc1e763a385aa817da01bae4b2becdd1796d4317994

SHA512
4489ae1955df813e580985d98220d2d0fba4d04746390f8d858ff1be5e8cd9b7fe14b5e359a8e484d21664b8109b6decc1bc3d0673fd168072cc0b95593bc97a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d347c481eb248c69ef1d62f41440b15d

SHA1
e2f8f5b433505337196ba1f03d0a037fd1dc5ec8

SHA256
338362ecaf770112ad5ea9121cf71b829af4cf73aedd826e038aeefd2e7cc109

SHA512
09b0bffc51d00c7be7d7300df2b97e9fae38ccb92c9ed71a58d6daaa7222326adfc4c9e83b46ac184ab742575d5ba39dc56689202f2e671bbd4003ebbaa569ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0999e68c502c3ec2aaf07b268f83dfa9

SHA1
62e2b0c262eb77362625db47cb08c047dede29c6

SHA256
acf1f5cb6b91d2d2548c92e9fe29303f37535caf181870c2bd73edde4f3120ab

SHA512
ef810a4622461fbade7b36dec0886fd1ed160caba745ac196929ceb6ad5333d167ede7f49589891cdd73565c2a8d0a5282dd43b4f800831723522c5646cb455f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584978.TMP

Filesize
1KB

MD5
9d317b33c9d84cf9f4a55d73ff952d3f

SHA1
e099e5da4ac335b69238e9d343fcb0420064d85c

SHA256
fe956bfac8bba2636e395641ce9aab73ec830de37111804f6d9c472954291866

SHA512
3ae3be907647b02f635cad73b55654d77777340fa3a8641785c771fd33c068ecc7d1fc9395a774c7d88ac3b27222b41d527de7cf39390fc5d4a3fb10f188e87f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4988a251c33093e77f94a32f0f7d9634

SHA1
8f4817ba4a4517a5692f859ac9911660a12f4d8e

SHA256
a013a0e2b1f0da93d0d8433e48f6f3a9f25c2fa173a19473df0f71bc450de9ca

SHA512
8a379fa338c27438ee1928c49621b1e56c88e3f9a6a687a5aea6c5bc376cc280b78bb0c1b5b9483216fe0a94747b3de7b6e5cd911b0b575a42c20d6bf0238c97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bad1a9471e3aa1f573310b87f7b2007f

SHA1
85ecbeb02ef79fc7bf9386ce2b1fd310ee108265

SHA256
31efd073473e6605cbfb56d5cc6f03840cc16d95337cb91b1ea45e6f9c128a83

SHA512
af6ce5a9019af731401c9ab90025a33aeb736a0256a951729375ad583232e7de42acf2f419e36291916df5fb524f0436cc617dec4717ec3daf8f87c8a05ec2d9

Download Submit