hxxps://drive[.]google[.]com/drive/folders/1p9zFGcSITnOAhhegnBzvrvlX1UUEicry?usp=drive_link

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2024 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1p9zFGcSITnOAhhegnBzvrvlX1UUEicry?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
1140	msedge.exe
1140	msedge.exe
748	identity_helper.exe
748	identity_helper.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1492	1140	msedge.exe	85
PID 1140 wrote to memory of 1492	1140	msedge.exe	85
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 1880	1140	msedge.exe	86
PID 1140 wrote to memory of 2144	1140	msedge.exe	87
PID 1140 wrote to memory of 2144	1140	msedge.exe	87
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88
PID 1140 wrote to memory of 1060	1140	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1p9zFGcSITnOAhhegnBzvrvlX1UUEicry?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1be046f8,0x7ffe1be04708,0x7ffe1be04718
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2248155558966049246,7523875112895550342,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3432 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\227780c3-b972-45f8-82ac-898c3085c590.tmp

Filesize
2KB

MD5
a1b6f83fd5f9a284e594a247b7f5b923

SHA1
3f0306b29a398e06009e6d726377027cbafc7b76

SHA256
b892bf5c79ac68689a569affc80ed1f7307098bcf7eed07b3631c1b7d124bff6

SHA512
f5bac9fcc3cd3d185107841acff0c1fa8c141a706705084603da3da89c9ee224d59dd68aef103a76d56efe4f688402fb1a863d9142e9fd7047eebbdc18318107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
51KB

MD5
f61f0d4d0f968d5bba39a84c76277e1a

SHA1
aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

SHA256
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

SHA512
6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
eeca798cc5c83bda2526d9839cbc9d59

SHA1
8fcf7488c935c4f310f577ea061a75231e6b8b58

SHA256
9635b03d243328132919187cc62dbd59abec19b078e7610f89ea7f4050164f4b

SHA512
61b191913d7a686a8887a983e71a8c05f2cfea7cddab75ec65efc5204c3df38871926d0c476d2da64163e93e7e9d297ab2edc1007c64a5db7edfab9a1e3675a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c3b49a236b392420ba8388b406b587c2

SHA1
b637bf71e9bfb4179558d279acff8d44b3ae809d

SHA256
b02fe336a4c70765474e0e913379477971c7c0261614d60aca9dac90f1ebcf9d

SHA512
7c5e29813dc3c95d3d098f505c4e63820aee6be9d305d8bbab261a3a4e38b51b8ede179cf077fbc4fe54313cf38fb44cd3eae21fbf6c0d596e8d42d3bfe945e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1e2a5208ad3bb3c0ba4b19c2d7bb99a2

SHA1
7d63f4de4aa5c6dbe838a27dfe9d292e37dfeb0d

SHA256
467b3b54edac1509bea68acb33309782840f66bd30dd6f6bd2b2e5daf4349b2f

SHA512
a24bde2b1baec2b0cf9994d75fa97a9c4e6dd597dee8781e471a9bdadd61e7fa4f346847fb6012e03dfcba45146fbcf2b1677744700a05d147eee9a583b9bf4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0a9149b3b69536c15bc991997500d699

SHA1
e912d8087122dba83bcf87d12bfea8281eaffaaf

SHA256
3093c8ad64b163ba728382c7e0afaef82ba7cddc16a9c96dcfdbf3629443e6cb

SHA512
c64875e8c56c4e3437bd4365c9a8692522f9628f7f477c99ab80299a406999b1cbd2322c610073160c862a0a285a03c5c5ecc90b3ddf64ca341d791e76cb979e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
ae8069799dd13cbd7598bfb2713bacf7

SHA1
159bcd293903636edfaa77be4f7cfe04996579cc

SHA256
7252a949afa3f5ed270b6523449773e866702db385fbc9ab75cd74f779d22dfe

SHA512
9efd7d1abd6ceea539e7f60d1c6be010a56fd276747c05f94613577f7c470ab4e7874c6a42d88bd17dc5d6d7d76c3172a2824795fbd5c9574bafa06f15bdbba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
16d0be53241367ae060f90c11854a029

SHA1
e6d63e3d0a29458a6377f4f4c62924c4aa867918

SHA256
468c68189cba1ff14d0d9332d4a99da98014268ca0c70d9568295c8f5a829b61

SHA512
dd2248d534574257fdade842c29dab552dc349f7b0c7294c5b4ca64411ce7e1a3ea7b1f614681e62ed621be42c38a6dbeaf60c782d5e80b8d1514c8ed98a4f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
2fbc0d17926330c901ff28bf02d020dd

SHA1
c8009d40f75e512d1a483c6bedf3f4201c6ccd6c

SHA256
4051a0e59be42aede6fc566c6c1094b6f0d2038c85e75753f823c98a4130413d

SHA512
0ee2c714de8f663251f7628267836e0cc151adf5d435c4da21224cdbce5d3df40e180521ccaf071459d711b6e608aec362c0d9517fb684a46bc4c138ef14e80e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e99c4908f37b85fbf0971ac536fd3a91

SHA1
35802e9f55f1bff672de259abf15b359a15e9272

SHA256
dcf5c1670eeb936b83f227aad66443a4a9940a7347e7ab6430836d34fbbb2f59

SHA512
2b0a50a2249cf141e8c5fd39e4d67b6f6fd35ceda4d1c7f61d2915f510e7dfb2912ec8831c0e0f809f613234206c460ff0819a282c9ba4bf82908c87a73587cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d0ec.TMP

Filesize
705B

MD5
9176fe1a0e0b3a4d10f06256e9fcd76d

SHA1
786f1ff5439d888e6a5b1f997eec3822a5a497c9

SHA256
d750cd6d0722ddba8ab560f3e76e9af396a4ae90b8a038c1ae99af1bfe2808a3

SHA512
747dc8be6da81e969269ac59512d168bd2731d13149658207fa4d6304949c0d15fc68c67b90553660d05f4a60eb7d9c54745f14369861bb03915701068d1322e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
16ff85496fb201c86201e46fe4ac2f44

SHA1
cff30895b0fd5de9e5dd33b80166d3f49ebaab98

SHA256
61880f94df7b5a983e81fdbaee5cf0af3dc28fb7fcaa9196ded94dc324fa68be

SHA512
a39c7fb23c789589352e9a326abd93efc8f5da332b378c2668530856ef5afc736df8c590bbe956b214ed13433bfb5c15240da4d1df899720050c203968336b7d

Download Submit