hxxps://drive[.]google[.]com/drive/folders/1upPDczO3lUqMAPZ1AgwVJ09YdXWC_sG3?usp=drive_link

Analysis

max time kernel
291s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1upPDczO3lUqMAPZ1AgwVJ09YdXWC_sG3?usp=drive_link

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
4	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
3508	msedge.exe
3508	msedge.exe
3412	identity_helper.exe
3412	identity_helper.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 4944	3508	msedge.exe	81
PID 3508 wrote to memory of 4944	3508	msedge.exe	81
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 4520	3508	msedge.exe	84
PID 3508 wrote to memory of 2280	3508	msedge.exe	85
PID 3508 wrote to memory of 2280	3508	msedge.exe	85
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86
PID 3508 wrote to memory of 3928	3508	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1upPDczO3lUqMAPZ1AgwVJ09YdXWC_sG3?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd091446f8,0x7ffd09144708,0x7ffd09144718
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2605230998470333599,6337963004037404616,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de1d175f3af722d1feb1c205f4e92d1e

SHA1
019cf8527a9b94bd0b35418bf7be8348be5a1c39

SHA256
1b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924

SHA512
f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
06b496d28461d5c01fc81bc2be6a9978

SHA1
36e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa

SHA256
e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507

SHA512
6488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
28KB

MD5
7f5a5d45ee4ea0bd1ccf5178c63f43c0

SHA1
71cafbec33de805f8c65c04ab40a7fc072420df1

SHA256
e47f30921e1d3fda22de0ed56c9847b80e379396ea95d3fe60e04cf9e4c9773a

SHA512
11dcabf8a16fd008783be04cf72e9ebcdc3b37a9a92c0769daa32fcec0a7ac5f1380d5e7636dca14eee05e5787419d2f5782726c94846c39085b325099c123d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ff92b491aefc6e4266d241dbe164b328

SHA1
8e52d2328fb38c66b6b1f4e311517d429c1e874d

SHA256
dd68c8e96937917daee313d049cfb6d1b32ae7f4cfa87e44523532bb08081793

SHA512
40098d0ed4adabd474aa306be99bae2388004f2e3e0c6de013ba15d194dfd6d9666fd17a400d3de35c9e5551fbb80644831d4c0b9cfe6cdee49f2918233e422f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
77d2db5bbce1e9b428e56cfdf0e41995

SHA1
f5b3822037d92ffb07cac14db2d81b4fbd5d77f8

SHA256
390a2f047c057cceab017c9e64b88f106556a809ad5143d83b0f13516c6eee63

SHA512
db81bde689314df44a6615f87ad25879ab3d35e374d3c8b3ee45ee8564da0d071e308b070ceb10f91ab80c1763e48f050c14edb9cc93d8bf1f4e25dab8a1ddb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dcd5a5bfd828792cffcabd9e471b802e

SHA1
374544f7aa821527ad3a1c35d589ec67e8bea726

SHA256
b88f5fb3c5725630ba70a2028544c12425fcb0c60c0db124451da603efe9e648

SHA512
92027d048fd293392be199f7dfe1e3633fe5a307039e546e0b005593acdf89bb5ef0148e194c7c2106f40960b70c55ece2aaf7163665d372564ff7b09017f4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
88b9717c50e66ad95da2ae3e2571964f

SHA1
b7e5425d26bef9c9c6f4207df020877bc1565f24

SHA256
52edd5b7c5d718e4c5f86ce65599aee1ba37c601d629837945ff53cd4a74eef2

SHA512
0356a1027333de17a897d2ccf5a616d4ed5a459d4bbd70d45d5b04372c7a8704afb70c987399bc98ef7b3f9232919cf87ced5d7a9398e813b1950912ba41a4b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
2442e8d3d376f60ce16b7d0e35632e75

SHA1
e79db5809dc52c191668dfd3ceba9cd94a623a1e

SHA256
2ad26a302754179f00f6ecc7305495d29a1ce4201691bcd98ecac42844f661cf

SHA512
346e04b5a01dd2d79dca9487b2c518b3f9c0457ed1a7a2b34a3852342cdce99c4d234364f98011f6a9af84edf3819a149789fe523c0e73ab6c57549451fad08e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
393905b9b9d8a8ba0838b412e89b9a25

SHA1
e8f81a479e2ab3f2f4517cc7d8eed29e96a1015c

SHA256
7ca1b6dba5cc4d59f205e2f59b179459263cab74a1ad2f1a6ee7923b52f4a787

SHA512
1cb1c31954acbab9a8b597f5a13ddf401901579d02353fbbe640c49563b855145f886729c76c290453dc5a300dbac0713c2402209ea03de64ed6161c41d3f439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d12c13ce8ad035fb888ffb0ec7b3eb3

SHA1
4bc4f0b194f2d20222cd13de577ba7756900951f

SHA256
c576fa5d0e4485469e17f2da0dc083b8c2816fd6701d6f361e68709ecd312e4a

SHA512
8a74af6b17a71c1ba496f2be0a11581567d13539ba403d0072c205d824d473f1ebd9c26537eb48bf96d262c2b62301be55e00173e5aa18b84232c4afdd4240f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f55b680011dc41c6a7110752652d4fc9

SHA1
152b92d15b2127f7d66990a1e6cb87bf5e3481da

SHA256
7067ff94260e0def08caac0bea47cc8c1fa807c09a9fc5d0df09af4591aff68c

SHA512
fdfbd832d81fdbe4ec5e9067d57de1a48a5eba3ebdd1af24be2ab5556364a55f13344499f4b5b38f895902c4f869c3b71465a2a94581ef9cc1b0064b5aa462fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a77844fbfce5b5743cee9518e96bed57

SHA1
448176741de1014a90d7b9e71e4087b83808fe4c

SHA256
36e3095b8c0d67e1cdb3d6e6d3c9bbd35e7e0f83b83f2adc1ca339852ebdc811

SHA512
586be4ee494a51b425009363168ddefead45586d26e351688480fb3e1182f9ba1aa04026329528c801d86b195ed432a0f49822e2f9b7b2c2a9cea1ddbb292c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
28edec0d063e684290620484006dc39f

SHA1
735bd4ca34b2476bd4586a0b78ce58b266d48246

SHA256
4f6f7b9100ecd4a52684fce0a0765c73ea299e25aac05a70703b2e88bb938eef

SHA512
133ab0c51719b7501639ca1003c552f18cfd9258cb39a33c26bfbb441dff730cf0703d591e6ba86c47a3943e6916f038f871b8260cae32ae99e8b0284ecb353b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d278d1a7328597abefc6f9cfffe34449

SHA1
8a69cac53eecbbd0ba0246561c52f10794ed83ee

SHA256
aab2b4fc410f419bfcb464b45aa889c657da2d8f6b1ef733308fbbfa98a77dea

SHA512
be6c80ab24785fde7cd8e7b32b17f52c25cb5357d4897be5614bd428c27ac4bce4d2298a8a4c74e36dc3f43865cc1447bd7746171570ef27f92dd5bf75b832a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
29648bda227dbeec4f3e1a1ae02f0029

SHA1
843a9c7370ef900930affc3493470bf13f8b1ff8

SHA256
978c3965a393c34d0e91addb0fdd696c06ef3cc1c615bed5f44b9679a9a1abbf

SHA512
5ac960482be7f7dc5e9c7c1a2c0fd503e795d4c35eecdf7bf3210ddcc8dac19aa68076f84258eeda236b65b2f15210644346fe183701813f0b1190f5e638adad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5815a6.TMP

Filesize
1KB

MD5
fe4ebf9ec2b42f2d15a153c05104c703

SHA1
d2ec6f74c758b1d8e11a0b13303fc096b3e3cf0c

SHA256
489cee4e4993b033d5998fb702ec23b5f0146e615bd4f66b949a08b8dcb50353

SHA512
6f61ebfa3b08522a874fdd1f268e3e237c0717273b9bbbb3ebf33116883fdba08a8689d4fce1b30ef8b48f13f0054b11dd0849e9c6bdd82f1c7fef656787e8e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a951cdae4562304e2348a4849f02212

SHA1
8683fdcf228cecf333c6754aa48d20684c6ec4a8

SHA256
f32ceb9f7185d3e790463dd3b81d756e10bdd602ab2c1889806e806b9bbaf4c4

SHA512
8101422210e064254c52ea8c7044ff5222c1b6a01d7e4142cf9a844db7ca0adb991ae06a2b6a26ca4d01ae84c4186a5d95ebd767eba42867b7bb301ab7a254e2

Download Submit