hxxps://drive[.]google[.]com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?7lZ81zayJZ

Analysis

max time kernel
76s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?7lZ81zayJZ

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4652	msedge.exe
4652	msedge.exe
904	identity_helper.exe
904	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 3920	4652	msedge.exe	83
PID 4652 wrote to memory of 3920	4652	msedge.exe	83
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4216	4652	msedge.exe	84
PID 4652 wrote to memory of 4224	4652	msedge.exe	85
PID 4652 wrote to memory of 4224	4652	msedge.exe	85
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86
PID 4652 wrote to memory of 4124	4652	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?7lZ81zayJZ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb12246f8,0x7ffdb1224708,0x7ffdb1224718
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6730388390061397490,17773558331147825225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
43fb13c7a38f07ea376253f416bd1c15

SHA1
b8c0cd65b3c715b938f7c4aebc620f09c38ea28a

SHA256
b6676d10ec29ba1171198d9a747774344674021cf0ea74334f7d99eea65412f0

SHA512
47ebfd4e747a13bc29e52b5e37fc40989d743cde643fc6991993fa9263fc6a2492e648a45f57cf2458aff2ec4254fe4887bcba8853ff83b380d05e72cb904992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
a41040419ae6c0377fd4296fedf559a4

SHA1
58736f08393808db6cdbd1c29d634ee4e3a400fa

SHA256
f0862c27ee93a2d90b06c80a7a0a5e2eb7ba6b1af26d77f9c42e6b7da751a60e

SHA512
03770378a87fef4e47db6f72c63fba812dea2c352251b5efb8ad2e3717807d249106a2dd19f0c800444bbc997c3d76edff03e085e032c3f3d624b9cd76b92c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f3ff6dcd718d2aa862017b020f3a6d37

SHA1
084aa555414fb605df3da141014e48c06f0614fb

SHA256
68d91bb61be9113040616b3352de1789dccc9f9279f793e9c431bceec076be07

SHA512
8290c9204d36e01e299b6b07a4100b6beef33d1ee990b9d6bc69af11bb35603035652915471f091b46e2ffb9e95cd2179db2ea3a7c7b85aaba34ed439223d796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0ca6e0fc0929f1d403612b6b7c8ff82

SHA1
bd4796f09b7935782a19eb43479800801d3c8e85

SHA256
23fdb9c36ca6bf10597393fec680c3f0a5816ab51c5d91eb3774a58e339883b5

SHA512
29f04663b5c5ec7d0b0b8a65eab4efd7a236d59d1246f15b415635b7dcdbb723ca7a61cb1c7df947344a0412e0daf47f6bd8902c519e4e16f9b058673aa9c765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
619ad55a556dc7b19fbdf9ea290a07af

SHA1
c249e3302eae80cc2292136671061a25a1274d1d

SHA256
1ed488da7c4a4a13ac0b48c5539eb657f0ce92069818797a31ab46ca6eee4e6e

SHA512
44feb0c6b4ad792f05f7b1573abccdc6442925488da7c1bfe6b1fe644f450b82129f9ad6541bdede66d2b0ff67b89225b3a81107b351a96af3fb9f007ab762ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac2fa0ab6584ffc8e8975018e8728268

SHA1
358bedc0a5e058cacc1cc6cddd5fae3443343b15

SHA256
2424c48dff3b8719f89ddb06624ee5471e70e5c6a465898f56612bbeb206a2ce

SHA512
5a6efe49e1f3dd677a57b9cf4fc5139dee2f054e89f4b15f6dbf12d94978dc3b9e52befcec3cf521f2f3efa31a99b9321c576ac65a952739c6a0793d210bedc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
14636778fa865e70a438826ee8e7fe10

SHA1
f523277279231feaa4d2a6ade0f121adbf4bbbf0

SHA256
7226b870cdc5b453e8d0daf040894f120890a5dd3316ecd0c3371459938e5575

SHA512
0e9c9a1b65cda81376ddbbf6321f2b6874976ba07f2678b56263c3509175cb5365d4ddcaf82983840c46102c73d0c8d97264a6617b9a33c386c977ccf4a33703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d0a6ecec7432fe0967882486cb4f18e8

SHA1
22532e157c464cf2cd8ee2aa8a2a194db8ec7bb0

SHA256
049f8ed9149ceeb268fbfaa6ceb7cd2c9972bb169340545f277ed40d43bc45e5

SHA512
271e514621a49284c64991e86f2d1562e2c8f01d122711723688b65375e3913154650556a2ceaae8b0071402bc0c8428dde1fdadd4a213253432faa4049e6a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f25a4ce7945514e2b5cabd303e71720

SHA1
5eda66b43e1c4bcb921e641328bcd3c876f57b79

SHA256
95fc4bcee2bb4acc63581c90397f0f2a3119634c2f6c48633eeecfb364ce3975

SHA512
adb2b7a4b4f7683928ab6b2b474b1a7ea8b765ba3a68f0ef258cee5a2967779e1e553cac0d0d69d1fa2e2600e40b9a4930ee6bf85fc3b22048ea177d5325bd3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e63.TMP

Filesize
1KB

MD5
ca915fc698845b233616b53630b0d0de

SHA1
e6742bc6056f862567033224f3ff8e7cf800dda5

SHA256
16921a2d7998dbbfedbf4f50f6494cc43d2b4736ab5a5e0b721703fa723f9e30

SHA512
c7a0eda70853625bb8ab95719bb7dd5207f0494a46ff157562ef983c194d0767bd9073b3ce37515f95b7d9e67e42e1ee748c41de7038968b0f3bab2dfe92532b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2cd70b23799d456f7d41155d333482e7

SHA1
ef45b9a7c883672cd3ec77be2fb045927de3ba02

SHA256
bac62565c214b7f4823d634ad4b0a5f1d1f02e1b3f634280534c626fcddbea40

SHA512
932d0e92e86c5032dd49649e038b274548d6884db0f33dc1d0a0edab585a9ae37052e53acaa645bf0823eff597908308fcc5724623bc227144b5bdd8431c2d7e

Download Submit