hxxp://onedrive[.]live[.]com/redir

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://onedrive.live.com/redir

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
1572	msedge.exe
1572	msedge.exe
1676	identity_helper.exe
1676	identity_helper.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 624	1572	msedge.exe	84
PID 1572 wrote to memory of 624	1572	msedge.exe	84
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 4808	1572	msedge.exe	85
PID 1572 wrote to memory of 2376	1572	msedge.exe	86
PID 1572 wrote to memory of 2376	1572	msedge.exe	86
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87
PID 1572 wrote to memory of 4232	1572	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://onedrive.live.com/redir
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffc13cc46f8,0x7ffc13cc4708,0x7ffc13cc4718
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14659784004398428895,14510952681872547469,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93d5b4c1-c294-4ef3-b9b1-016a6fda6deb.tmp

Filesize
6KB

MD5
5967dcefaa634fc92dc57786cfb1a835

SHA1
e1f4936f3b8a5e9e9b33a2bc88c8b4105d01529c

SHA256
be5dd1e0e905a1b391f9335ef5e82ab98d9282ef2bb468725cb3eadea5e64797

SHA512
79aa864fc239c64cd96104e40972c2a9283460a17c5a2e4a6a84b0ad17229de9b45b0f29c0f33c3c2e07f7c0e68b409a1c05304d61e0ad9ab06a5b8ed919ab62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
b327eb94dc2aebaac353e91a566da0d6

SHA1
30956bee8cc78c20975c38f3b5fc0719afc6f8f8

SHA256
a0b28d27a51f9faa71cc7329c8ad6c595d19a24389c886461fadcea1c3234696

SHA512
4ca9f59d7351c81b8d17f7afce5e2a7143b742f3c6b113f095002c05f4ebff3ce41ceaf273edfe1e4999643a372b9d4701d0172582c89f6928afc0e356f99e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
e5dfdcd3ed35875deabeae27df7be67d

SHA1
38b9105c0d0e4aca026b3d0d5ee820186cb11f7e

SHA256
b9299af55a66e51293fa2fd0a116779f05f635b2e7bb1003528e16fcfe615cf0

SHA512
afd2494f1fa8363973c8309bb3c97c4906b2fde3581da318f180eba9da2e041a81f73e07b00e9b0ee16860b74b2d9f773c56c0080ce099abc6834b941fd2d7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
260B

MD5
23c5aec2af3537add2244757db408001

SHA1
e400ead29127d89858f39c4c53146aa4fc7038cc

SHA256
16e80c8c5538e984c509134c96dd9babe89c646e1276ee5f7d4227e3f82975d1

SHA512
dd9901e87a7916823841c3c4671c4d7726fedbbe5466d004638554f87d59062686340519ab8b7c4c24e3d7b68d89d78fc438f505b8cd52443cf7681ed74eadde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ff4a52f53ff783dfb3f2e3cfadde5f01

SHA1
15528c03bf47eaaca9625df7f04fb1e810f1c150

SHA256
d3ac9d272c4eb7c005cf7b9d91eef588d84c135a75d5adca06c5e7d5cadbbbc1

SHA512
244a33cd7024af429a944d5b0a29a60dd8be2faa9c4b88a599ee5e667862867d11480503349389ac97684d902c5c9d5af83c906d1459ccb7fd3c2b6becf6585a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
742ebb1ddf66d64a45f307259c991f7d

SHA1
1e16fd7b9ae885565704e8080454457fa44a3aff

SHA256
f7d887bc7f3b791fa869b8b01956e5bfd6379f84559dcbf5e266f9450c83f432

SHA512
f49b8ea527caea0a7f4a98fc5264e9e3317e5b595dfc83b62e03a5daf81dcb3ffe7dea284c3b8caada5d98f47596f9b4c6db2f09f9785bbab16594cc249e1cf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
81b24053e736a172758df98683641279

SHA1
cecbc4d4d90fcc5bcb6ff60d16bd80f1e0ed288f

SHA256
4440995b628a3faa79688d02f9a20ee374d75d361c05abd31df9e3453c070979

SHA512
dd3d83058a9a33c480721911147610f663e001c87d31ae33e8bc5e9383d6a397c430af87c42f7137c97eaac07e236097f4078b9125bee13f44de433180e9637b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59ca4b.TMP

Filesize
372B

MD5
ed2bf595866f519350ff20c76ba752e1

SHA1
4b672a5d9de6121fc7daead41e8a08da7a1ad07c

SHA256
85fac746d14950d715499d9537c8d4b9d68965937db5821a9153b5f90b12690a

SHA512
93234a662a2a0bd8c71cda5472a86f97aadcb3668de6965b94a91f8fc829790177f92e566f0d62f829a7214b60d097addce450f6648156a6b86bd6cedaef6a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d2d7bf52a6b1e54037dd7568213b026c

SHA1
d754b2440f2c8c0e56be0717ea34e2a8132b9a7c

SHA256
5ee6f552b28fc3127a7266a1fc249847012acbdc70388c131188b5e39fabd39c

SHA512
0a3ca69f6e43a8d3989b4072a578276aca9848ec240d8582a49516ef445194a43fef07a41c517d918227fa51368c43c113b00034a41b4d2b74dee127efe64e93

Download Submit