hxxps://drive[.]google[.]com/drive/folders/1zBMeVvcDWTtzROlUmONmD0-JfpEb0tb8

Analysis

max time kernel
515s
max time network
520s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
30-10-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1zBMeVvcDWTtzROlUmONmD0-JfpEb0tb8

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
10	drive.google.com
12	drive.google.com
151	drive.google.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ecba40b7-676a-4da3-8bd8-f21ad3b0fc9b.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241030221340.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
4064	msedge.exe
4064	msedge.exe
700	identity_helper.exe
700	identity_helper.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4080	4064	msedge.exe	81
PID 4064 wrote to memory of 4080	4064	msedge.exe	81
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 3056	4064	msedge.exe	82
PID 4064 wrote to memory of 1148	4064	msedge.exe	83
PID 4064 wrote to memory of 1148	4064	msedge.exe	83
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84
PID 4064 wrote to memory of 2920	4064	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1zBMeVvcDWTtzROlUmONmD0-JfpEb0tb8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffdf92346f8,0x7ffdf9234708,0x7ffdf9234718
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7aecd5460,0x7ff7aecd5470,0x7ff7aecd5480
    3⤵
    PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1004 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=932 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5706485702763549602,16710209623673924291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9d533e1f93a61b94eea29bf4313b0a8e

SHA1
96c1f0811d9e2fbf408e1b7186921b855fc891db

SHA256
ae95a7d192b6dfed1a8a5611850df994c63ba2038018901d59ef4dae64b74ed3

SHA512
b10de657d0cef4255e96daa1b6ad0c99c70b16c13b8e86790ea226e37e9ded1a8f8bed1e137f976d86ebc3ea9a4b5eb67ce2f5b0200025d35dc8e94c947ff3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fccab8a2a3330ebd702a08d6cc6c1aee

SHA1
2d0ea7fa697cb1723d240ebf3c0781ce56273cf7

SHA256
fa39b46c6f11977f5a2e6f4cd495db424063320fbac26a2eae7466e82ffeb712

SHA512
5339b52bad5dff926b66044067aa3e1a6147c389a27ebd89b0f16e1267621d7ce7af9810010bee81cba7b08c77a33ede8ef4675fe049b9fb2ed510fcaef93d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
369aeea014b9bf8ea038e81dca9e1084

SHA1
4521f49084af7752e9cb5969fb620bca17cdee99

SHA256
7303ccfa775f1d1eadce8c3b022abbe1317fd5c1cf273911d8b938f45de2bcf8

SHA512
1abad1c4b9616a1b52a7d216807ccc9a97bb64124fb954f3d67cac1319879498e3845e85bbda086ce2ce1b967de3d909c55c15b38abad656b88452a7a2f70f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
109ac82cd4db22db075068d737e8c649

SHA1
bf5ce25545c5db97f7fe63c2c5ee10e93c87fe71

SHA256
cb14d966000db11198d047d6deafe2d6b92bcbb3fb51e6baa74f25e7e6b76160

SHA512
03029601179e698cb1fbdf60cf5c657b7b93c1a17bd6c581582284fd03a1626ad58be4eb250c018fecddc33e4105d7d67e8e356eb511fd8f3dc076c648cc9648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
afdef2c7176a8cecabd07b7ebdd0f926

SHA1
1da80b64230edfc7a112ac81342bbe15a9a3fe71

SHA256
999a1ba0b01ddeae1a9685ca37eb6345b7d7883f293a992b81f0aa3ffe478952

SHA512
3dd8bd3e02564a0ae47d903e0a97c7666dad7c292699c342feb1ac9ea0b33b705204ec4a7ef092bda318269f12783d846b2192da736ba862493fdffcd667e25e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
87b59af8619bd7b43f4d9ad7c8aa3f91

SHA1
b8a1a5063d7d1205b1ad19894ce6cbd07e911ff1

SHA256
b286e15e56a71e097c5ad6f8e5aa26eabc434ae8a16af13bc4891ec652dc2dcd

SHA512
ad682e176c585d978d6f49b0f57fef1b5074be114155066c057e50d5512caeb3d1c8731d510421a5b95ee4d85e099ba9a28b890f288186f3a17e0d7244e87686

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
eae7e84f9ffb553b66187b9448212d39

SHA1
fb2c48a7113d3d637fa2c1068c48e50c6b893901

SHA256
3b496606da4f61d41fae9f2771bef21284f0ecdfc4d8f3640d27bb97b66ed64a

SHA512
a75c32bf57b9f3163d2aa5f92115d31485e1bfd483e09e60a1a0b33306e768bd5cb35f65b4e201a45751d78c495accfef1eb71ecf52e925e0da8f3c6daafae2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
df0b92853a046e7459686cecec6e0b5a

SHA1
e12e672239e651fb21a56a18a0f5f9a66170cad7

SHA256
b89ce73065c2a1613a8a397c6cbe382738020bf209275614aa1641cdaeda9e60

SHA512
83a5615e8b91afc3bdd8c3519cb683ff319204be12c089447fedcc21f83bf426b13c3e264f4b2bd7307a7d48c1efab33f46f0086f60250a118b5a0c55a96bec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2aa2b61bd1df359d190d65f1d8a716f0

SHA1
01059e66878979beba79dce8b76d7f4b44201251

SHA256
0b95ce9f8dd5dd412bfbdbc1d5455825f960e6f63c5f025a8dae6547a0ba92e7

SHA512
71ea34a99c95b1f6188857bcc748dcdec1df3874224ac3c6093fd7d3cc96477471b97ca178d92f635eb6893ebde5851013ac01e2425df110235055beeb9f4bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
21e99b075d435a58d7effc5316d36994

SHA1
57783f37fed847909081eddbc97973cf9e55e7a0

SHA256
d3c71a7af3bc4ac8ae41d7f8abd4ae18d1526031eb7d7fd56d26cc6962eec71a

SHA512
cac5dbef490ce8f26611eb8865a465ff0f7d1893a75734fc86b7f7d739c307b06f3ae01f5d785bc79a40e060ff0490ebfa4cffbbe7d257f1c7d541f04051c239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f4263d5e3b1607d8bb080b6a3fd7ef8c

SHA1
03fd83a050c4e092a07fa95d8ca4490c4b1abb84

SHA256
7d757889e7ab5db415885e7ac0d3ffa24e7ea78ec5db9d5e67a3d7568e305e0c

SHA512
5a490bbbbdf483475ce1dab0a48a8ce1dc0fa669ef1bf42b495f92e245552d7f566555b22c7efe3d724eb7627d5e763e998b04a977a40a7e825743bdcaab4c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f494fee90a99a8d4cf254147e33b965d

SHA1
a392a0eb1744bea6f22fce717e1c53ff70fa97b2

SHA256
eb35d1c2c242dffc8f5a27b2bd6ce1c9576361c77266b4201ba19a2f1e6f9030

SHA512
943311871eddad8cf425defd1e10d3783c2583a975a8b077e06fc31a9759494b82ddf79df18c254bbab2efa51c56f21fea9b34f6b9c2d74f946f88c71a1eae07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cce061988070e5c4ba1151aa67c6376b

SHA1
c67d0b24d5d7725779bbd8acb32432772387adce

SHA256
6c8a7e17539312fb356b711c7afc95cbf393af9c3a776952263272cc210e1609

SHA512
1075f9dd4a9e0d9b59b4fe55e45421f8c2454a12b42d347bff309ab61eb60d3d91c3ccfbf7135e82439cb6ccb310d1783377a30322f1d744a620039c998b161d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d83741937ffacec6c5459bfdfdaf20b3

SHA1
27bbdaa6067f53905f7ebecee4e17768436447df

SHA256
b295c84c9c806942ea58bb80735c147033f2a420de7c26425018e64b795ca9b3

SHA512
c3ca39fc08f153ead4ba63f8e663ac200857c3edf6eaef71ea87980a2f0061be06c4cd237e31057ab49675f72e4568bd36b5dec492cd78e88dfc64eec5840328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b83ee468d1056803100264093e1833ab

SHA1
5dd49400828989fa43f8373ccda710552a5c28c4

SHA256
9add59f25e9b22bc95930a9d02c23fc5a1a8e00b78e5939cc92a2fdc9e58964a

SHA512
f91867a08a2e0ae5c005745935ac68ba1601ab4e6d51448778a5849e0232cc120ce89e3903ec960fc164642da1f0636c91d4a69cce7bf79d59e9876677b96188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a839b6d334feee6b6665f497d759f16a

SHA1
3bea1edf92ed9b4a1e09cd0183c683fc794c27f3

SHA256
4bef17b50ff867d309ab521d2ab53d88b37b98633999bd6365d0cc99cc8cdf40

SHA512
3703a03913f5292e94c597e6f1126694d7b8537c7d4f7d2f7aa65ad7965b6220df925e23d2b0e468ee13202b829eaacfda731a38656c5059e95ffb61ed2a9b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f7d8fe1b8a6183c5b4e3453553441c6

SHA1
94b8dc2c053c755e4e77a132faad9c89c07ed87a

SHA256
5e05ab2bc590d3a8121c533be134441c119b60dfcd0bf75f0e22b1f13585ca8d

SHA512
2775599140c6670c1124d5a91fc79f00fb3b502844308811e0bb39783c52a57aedf3af196683721e6ac546c88d81933a7be4af4fd0db8f9f74e32f4010d67a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6454351184636979300cbd3870cb3702

SHA1
ba3d62dd6a21615f8fb8cd52d30aa21eecbc9476

SHA256
204932a76603870e2bf5664675e51e036f8e1b939e4d79ff73c0ca788ab15ff3

SHA512
1121a187935321d2f7caa155bccdf50a9ba76d8df1764a96558929d0839adbecc8c2f6c36e13acaa622aec6576974e2179af54e9badd58f6285fc619b859529d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c2a792cf9c455620c29e658af8914b0

SHA1
d36dc738e497c715f88148d2feaedc23e42b0d6e

SHA256
f988415f87ca4e62c339fc0705507cfdf4a74c5b1db019954cd83f219add9afb

SHA512
8db3d0039dfc4db2c9c1767fe84f745fd161bf51e7f27e54d3bc4e6e97982385d7c3ab175f798002a0d3631f6953e35fa7ff0509871f79714ce5ebca8b6e6452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ed659b1d7a51e558246bd24f62fff931

SHA1
84685d6f04379c290e4261ff04e9e1879d54d42c

SHA256
23fafd9073812d5ff8b523b84bc981e4cb410bebbf3675db2b29cfac0dae9690

SHA512
1c3203328583241895db9fb165fcfd595f642e218ee3a453ab6873cbac10ddab693cd2f913bab15c8bb7b5a12c5768b3dfcb278aad754dec1fbffe66b81843cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ec09c7cbd7cb0b8a777b3a9e2a1892e

SHA1
3b07979e57b6c93be7d5a6cd8fa954dee91bd8dd

SHA256
a623633f34a241b0dbc9fd26f34446d716955f94e90b2ff9ac8b9df801bdae5e

SHA512
5fff0a38a3b6e4b29d402eef2650011e4d9df514e0624767c84ea31cb73cbba10c7e0b5711cb487976d637f0f60a85c431cf0db54b519411245684c116c07b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
66e52037beb38a10a2ebe0e64bfdfe49

SHA1
d01e43a4434d532755b51582e4b110d3a5b708cb

SHA256
e919f14109896266d306fa4689af172b6bf5cbd31a411a7b73ed3e027008f9dc

SHA512
58af210ab88dc05cff660a2d90daaa2b501225bf80408cfb7a6a325a45da9d8cb4fa5dfd734b28717409414233cdfa66eede78a079e5557d86216385ae21c69f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6091c7d21cbbf9d6ed5b1ac17497ef39

SHA1
8f43ae96b6950298144a0a4bbbe28316998d1896

SHA256
2f7729724291734c6147918289da84f4a7129437cf2cb0a6bc5f2e0a1f8c9402

SHA512
359c1acc141e4224d337c310ed2755bbb3501ed751c9ee8e9f16661e85aba57ae52cae1ed79ea2f91c5b4f5cd134c30eb6b15e163e64a3a989d0cb17459d8459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
98a38749134d16f3a43d06b602ed2cd9

SHA1
e619186027d214e25d4368c149cd07b061455bff

SHA256
2266c7195586eaf0ae6325a8cc9cf440c7804bd62917af27c70c47160a90b73e

SHA512
c60a874f1f1c5f5c4642c86aa5270c1d31a5db162df2de7dea9210fbbcbe6fc080d73015fb9030c3544bd29dae8ff183970f30d8ea106f30c6f2b140446841f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
07dde9b6c59c59f60cb36bbe836fbb73

SHA1
b67b51fa9f0155d30602f95a3749df0d8ff79614

SHA256
700e419884089d657a67b9c720c19b53bacfaef3d6a87688c6ab0f5282cdea15

SHA512
0328ef6be22f75be2d2b15c6b64a63066480e495b0a44b7417091f43fe1e6f97a69ba16d063022ceab4905bfa7f4370e4d14256093e32c355e338a0fc831f3f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
72e6f5d60ccebf7a89a7f9cb724d9684

SHA1
2e02eae1b903a12be8e8da77d2ee4cde3fed40ab

SHA256
520b97a1a16ace3021b78d79332c18d29d21115d79a5b3ae2ee9159afcda2435

SHA512
f9d85485ba12ba1fb62156e7d4475230dfca1a37cb2b1d6a9d109047333b677066427dd03a5d066349b6d22d16e85b3c712a37c6a12d32b0266b360168781680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4144e0459248170952cfb1f95088e543

SHA1
f6cbc4806ec1343431a36042e41ec509f236f66c

SHA256
ed4abf727f0234539ea1965aea72bf359f310e978f02627e13e2c0e286282ebf

SHA512
81283ee4e4953d1f42778a140f1fd6b77d21e56cd376fc5fc2ca36b180bc1da30a17059c06491cc88d9be5a3d549712694e7b3b4ce3cf935ce909b08aa56e0e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ae68158ee12a2198820a7555d558c8ee

SHA1
891a8257f3f39bd1f00c1c41804517257791bec0

SHA256
2ce489c7ea8763c88b74a148b72024a89f0ce5f8fe324ecc666f80115eadc2f5

SHA512
ef2a19794f5f65d9e6cf589d6f1e26f5a48d87899381cb72e65add0d0b511a3d5fcd75caae88ec2a057e9147125487af533d02dc2be8ebdb4bc6f8e02de7ea8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
daccbfa9fa223b1580ca24f1e369b8c9

SHA1
51c73efd844e354dbb4e49638da5d089a1d30b20

SHA256
098f20148d50247204fa6c2613ec82c1fd547c66802365a76f6c662788293fbe

SHA512
c85e528e81fe900981ec69e9ec7a2f13493a56f735b243929eb87c22a093080395089e826fbc1d34a70f0e55923310ef5e1629bd4718f4181c7927fa1bbd61da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
82cdc1cae36aad7723932a095f086dfd

SHA1
5cca311d2c2ec9450ea1d46a944c37eba838d1be

SHA256
3476802c0dcf291c2f97b73dd4b2429e439b65c1c34f59dfae9191a03a356927

SHA512
7e11b00642cec95607eb1984afe4b396d7e64f39c4f3811b712f2797923e0d042441b5e7c3f68ea89f351803c7c2242bd7a40e71a9377338da539391880723ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ebe42a875e1a5985ff10103a063115ef

SHA1
a8e327817ee46a350eb5a0e29386264da25235e9

SHA256
d03e7068e9ee29d31139ed185e650072d201b8fdf2ef4988e362e2205ea0a54a

SHA512
4fe0c5fe37b33a40f35b0b73bb3ed72a84c7761f47ad93bb08b393d1143089b828bb10d7fda15deb6be0feba7c6fe0b1ae61f1e1efcaf0cd545304bccfa27ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cb135e6ec82b1886f0926ac4c120de44

SHA1
b1dedc85c69d3a3a4f473cf9a8dffd27ffa021d9

SHA256
8f97ea82da965144f98c7a5bd4c36a9989e9537d0ed9dd2e8c29a726c3ecd340

SHA512
500230ca544193d2221e2eeea0e089e6da17d048861e59eab118e9544ecb938c9175086f701f376da8fc8b96e67581e296de3cb990efe58e27b95f61915ac24a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
85b1aed68c0c9a5852013cc234e025b6

SHA1
3e021d7505746ae8371245ddfecb692ab460a91d

SHA256
b3ef418aac44e38fca74b8f98a81c4a38b5c4e49b075ed3034a71ab90fff7d1b

SHA512
91d41163a57caadf1ee178f64704cb7a4e259f6b9f4cbcdaca5e5589b2d19bd8016a94d4d007834b6c5aa0b5f22b0daa3e2d00c204a232b7beb1911897385be8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
43bed87b20e49d1e235e2526fcb7baeb

SHA1
47ef1e7b0863d1c54250e5cb81a8fa7db0ee1f1d

SHA256
e76c6f42425bbd7ba90c6fe2ebb7d6b091ab152f5759f7cc5fe2379f52a88973

SHA512
c5bea1d62fb8d236b24236bb340ca5e99468671129c5d47a0bb2ff6f2914ee2e3787b604d1487faecd7a51873cbc2653ef443f458bee32e09e2b011f5c752724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
38825229fbbeb89096519558b387acdf

SHA1
d3f1d1143000896138ab8b94ad9b807503fc471d

SHA256
c17bb7d0a09b0b89fef57d04b787aea137804a4a146e125450b4b5fe6967c11f

SHA512
045d8d6669a8af2e1c159aff4e244d1d28bbbe0b8d7cd2effce363616f0a054e379d02b728bc2b2cce665aaffa1150749d5566e4042d137b6a9a6abff75bb5bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
022d9ae3da6e541b0afd5d9ab223c9af

SHA1
dd5f056aeee82be418564dc7ab914528ea2b4759

SHA256
5b4c1ae175bf57ba57fd1a3de7a3287d081163136f5e02aa33c84f27ed04ab9f

SHA512
79fbfe90b9adfc17525294a97a58bade7489589cf31c74cd68a20695e620a7fc71d674b1bacf2851c173b9ff1fbb7b5792140da09f92014121a36be4208bd7d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c0c5166fa919481396ecc2219018dd6e

SHA1
e4d8d4c599cd266198e4b9de503ea23ca87ed355

SHA256
c7b09c98a856b15b420d461926ef4bf92516ac8f1800a94217ede6597b4c815e

SHA512
967d63579ecce70ace3e2b132436df97b7c89719e10e60a631ae8958011937d9ceb6eeb2c314b7bdcd483362fcd8efcd3288b37711e74dfec7be73f8d1227d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3381f606a017fab5735a921452f0f37b

SHA1
411a5e110f1526d57dcd29a1e5e62ff6fb6e6c46

SHA256
effa1d0638b0a225863b625959014a89eb381bb560212b0548c1b53a5b38b13e

SHA512
e6050f3a34c2fff5102164ce489e759763f1f614b61a7f3b0481063d21ec8f7db4a602fed2ba7b92b72bd93e923fb51cbcb90c0abd4e368be5fe870f2353d1e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
611444a6783218d98c655221bddc968f

SHA1
8a740285f8d9db6bb9a38edd53576366853ee586

SHA256
89e4ed24384361d7f08baa3b1838b4b2bd90db8cfde21fcf5b9d45e4c7c41191

SHA512
8756572d86ae8d97cb77b77c4b196af9fbea595ebd24a46df4108023c3da70e326845273b084086dd27324fd40eea24c8007fe6475b6b995b11f7c9eb96617a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a969300977db1a8343ba4a6aab3ed709

SHA1
1dea35b8276c54a8ea4e9f143d44e8389cd04511

SHA256
ee746211bb41e15af4ed882c515951bf47a9df87186d687de91e71c77c88a161

SHA512
8aacb0e772ccaa5c37bb1a9237de27768efa5105dfed37f47d5dc0c6b82668e6b9473fd6bcc19058e029f09de840d080a497aa17704cc27ea5cb58bdc0170167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b6e75c72fa1e4254a21c6ac56a1647c0

SHA1
8db7662c73e044ee150e136edec3b3ee5e8d3d51

SHA256
7d12580157f22ca810b8850f45a5c05cf174785e687cc39c066badb00e800701

SHA512
c3a648dddfb24e5863756f235958453be97eefbb7fac65cc1f770bc24bc3fa9815cce7fe438093420ddbf3278a0b70dbadd63d0e13c23da1fd5470d7fed1503a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d1adeae2c93f9b3c1d7c5179336df97a

SHA1
909fe9c313ddbc7d841fe2ddb6622f35cb5427e1

SHA256
4defda535221ec124a300c31c012b760bbd207d049a13900e5f165cebdf4001a

SHA512
e15864ef2c648f8bd3b877ea2b9746758362164e742f6925937d44a8470c83dae207e3b509d68aa793681e1b1fd8819053d8cbf4a0c77c63098191c08bead4f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8cf4da89238209d14473c46540ad8826

SHA1
a7fcf122fce544bcef2b2d39b8ba91777c6d3d8b

SHA256
74e872d1ddc95e9b15381ac3abfe3bd6f3f7e29a68b39f1f623c7521dc9c0854

SHA512
70132206d66151851df3cfa80a4f5d596ca12f01f9d78f9f29c20bacc4d9d549d4e88e39ccb27a7808aa65564f4dd800b9a165526812002fb50fb8a8b7263b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b5aa8faf2ba15d4eafb7e9bf11a98367

SHA1
db3f87fa347e337340965bbf6a1263fcf161b784

SHA256
9ed7c0fb49af2676b95195efcca4145eea25eb81e2a5ab95bf910e03596835e9

SHA512
6bc988a376fdf36727ca856780284fdf555369cebf04df41eaafe23488d339c8d196f90b533cd1924a9707bfb4fc04343199023c98c6a011f99588591c40581b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
27e8a92a88f5af65d67d211ce9c3499c

SHA1
91813758ef6e9ff3b26ee7ac51059f891a328355

SHA256
8d035a4d9680af74630691aed7045da457e6804c25739b875c85335e8c8911fc

SHA512
11c764291d36d3377af8f95f0b98d004273189ebb5ab7c4958f9455b5dbd41e978a9497343ccdec665cbd625f6ebe83ee714371aab903e062d11ae9f313844df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cd2c59183c3e2275aff77ae12812f0a6

SHA1
4938fc506e601cd7158020949f1892060f07ea46

SHA256
f196f948355c47150816ac9068ea00c02d2e885679dc0449fe154a17f4de3f4f

SHA512
b36bb64093c00499e578a3ca43a97202cf3418c64b837cb9d48f2ff5f6a71941a8d572da748d665b95b8cae28eb51211e577c710621399061e36bf3e3fd0f988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b0f09fa97e3fedb9c47a8122e7329645

SHA1
c42312612d1e5a01e740c2b5572760b30d90d09d

SHA256
9d091f4025f54ebd905e1063282cf0e9c9dadf51e25eec4e9e9b14aca1123a60

SHA512
81e3822454e49ab0c404b6ca1c31d60d263623b3299a084c4eb8979f26583f1e492ae9b3473cd73b16b98e021ee938f9e48b172df97412f3b2f5f7424aa1ce2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d37f7eecd291eb3055d4286a9b0cc5a9

SHA1
c6908bf2f955b1b9b55a63b07d3b18f03eabb891

SHA256
cd6f6b9e2535e1be590998d29aded33ffd40cbc8cd97f1fefab73f475d7ef7e3

SHA512
7bcee38f79c0985deca433fbb40f82c2f5e625bf14b5925dc92407ee09077fbe2d7410ce938c25ef762c2bd4b5ad91b398c6e385240b1f7b67a00099dd46cf82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e3f7f4fd08319417f38eccf4886acf47

SHA1
20ee60349cae1e3f8028c015ea4a8adcd1c1d03f

SHA256
79353fe6eeafb3684a8d410eecbf2eaf6af06bd0ac746c8f9af083a0f36fd1db

SHA512
897434f263cea944e9893bb656c44131084c45d4da34281f18bfad1c6f08d628ca2beff8c53fb67716cb4e0848d24ae86b570378acbbb5b5d45a889904524bbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4073428a0974c11ca77ba472d6fa379f

SHA1
e4053e8ff31aa4ca8d0bb5481d53f8a80a435d89

SHA256
89680eb587ba6560aa74d50b6acca6f957544c46f9c2dc716bbff5061fee1111

SHA512
b0fe9619aefc05dd8b2c8a2145b7a1b807e4af234d50ef7b52ff4143f51fae37605b2fb107aa7f4d44e6979f570ff702b2fd6419c03f95983431fde7feaa6c6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f98f32169a038342b2aff6baf104106

SHA1
4e02201eab236be1446f803164d957df425f90f4

SHA256
c0a969908ec6636e9b3decc2c33eba26068cf38d3b5d0b923ed97e9746b10b12

SHA512
817fc9844049b101acc910b75bbf745363b8aefad516223dcb43219d073b77538cc9ce0bb434456dd7a0c4dd8042add6e7d423efc2c79d360f80cdfc817197ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
971e8c20904bf86583ee40992fb36a9f

SHA1
24b15a6885c127b54599970491818b22beef5893

SHA256
1ffe4cfb1fa56c7417b98823ce1237a306e3f3e47b6ca8f25300695acd448bd4

SHA512
506d9de53efd08e27ee5fbb108c3b23c46212fc8f01c3a068e343b4a0355d24669bb702dfbef8fa0e31b03779c5e0708da8d678aecfb8d720bc83a82c832b7b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d04bf01e8b33048c0d09b165e0827387

SHA1
ba82a1f2bf1c420826788090a1f78b51a44c3a24

SHA256
df056a6c4c3a31832354fa5bb187705c5605a5eee7b3615d26e72fecfd1eb8b3

SHA512
3ba699592424648ed8ef64fedac8c79e6b6b548fa4c98666676c2b0e34bc533118fe392da28cb77228378465da9062a3667ec22c4a1fed7d0a58e67c49acc866

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
16c30f2187768da00d0381ede75b0881

SHA1
ae528a24e9d4d9c9f0f05110f495de392366d393

SHA256
1a2a5768c08777ecbe6ddda72d8e7c5d7a2ed9a102c31806e8ff6ca3c2b7393e

SHA512
1121002248fb1ec0a3e814c07117b11103e6aef167f8371aa4dfc06c439d690683488f4e423002308aba8ba04d620d479066246ed8b384df80467fcdaa236135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
18c5399698e9eb18f69052e5cf913c04

SHA1
49f3f185cd16608db3dd7704a5c693250597ac0b

SHA256
309b25de5ccf2449e34ed0ef556227996352afaff3d037e50822e0d5934b4580

SHA512
c7c3781c51f3f6e11d424e697e000912e0ef1057a31db71df138c9b75de317d7fecc2c4a8774b3065187f9482f0354b7903785d9d4628d6cf3dca80b011a79d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a9d78cd33dff9e5ee5804ef720cfbb7d

SHA1
a8790d110b412c33e603490280f2d713399b64df

SHA256
f35fa9ed6eada2471e4560e203fe1fbbfada6575387d3486428e8495d61dbc1a

SHA512
51658564e6c7e9534e4ce679154a0b5fc0271c1933d5f6c2ed46350c67c31362a751a867f5a69bfdfea797f27fcdab81fc39ce40cded9964762b4d22ee6fa08c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2fa66064e1d8c0b76113d0e320d5946b

SHA1
d9900a99c797771d0c68a3be48abf5ac2e87dfa2

SHA256
8c9fbb040b16c5f63aa75010797e5a657926f3f10d4f88879cca37cdaea5453e

SHA512
1cc7197519ee00042c91d02d98869cba8d939a71afdc07678e1cc442f62f0812af18dcf0dde240421036274ceaa6b8930e2f213efbc9467e36839452fa3e992c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b8dfdb3338fde801bfe38cfd74dc113d

SHA1
337393fa5ac5849ff12854e19edfaa45d95a8034

SHA256
5b6057e82f6567efc10672842f0b8c402031b9adfe49c459316c946607178602

SHA512
baebf76fb84982d7d7c11c14ce96bf06a28d72436733b50f7909bb553ef11c6daddcf14497ad9e59be71cb44148deed9f0f6efb7b67c34bb3e1dfc327b813ed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0536cc5f277ddb9b7279c155e59b946e

SHA1
2d248b061b34efa5b0ce7eb2924a9081122e1498

SHA256
3243a0fd12b217afc63c6f151bceb705d28dd232a175c606d207ea13e09c9d64

SHA512
1b671b927ab8d58d892dd83f1705f7fb9f1b7fa62c1cd5819f00499cc15679f6172b4c27e1da45e7c90544afedf85b939fabb69b08b7104b9461a9edf44e1f4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe614b70.TMP

Filesize
1KB

MD5
a8a02621728ed3e95edce921dd1bab5e

SHA1
39219bf41d34e6d632ee858e45a449ccf584f4eb

SHA256
6565b416a387c87d0503d83e0bed52a330e6ae910078da730280c2d36239ce41

SHA512
eed746cf3d88eebd099f47734e7761b43223373ac76b181965d63706f50aa263f6be126178429f95edf705e783cbebb6f22262a298cab7f486311ca765a4c549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
801edaddb00aa17afeacb7e379b83351

SHA1
1cded5e7e02eac6e2ad4e3787e338ce4c4a62b99

SHA256
cf1e5249c9fbe98bdb1d661a87cec046d9c9179fb13e53d3de124c7c1ba3c4c0

SHA512
fff96287f9501907473cd3a32cdf914778811bd4fafb1bd5fcf078a57a174f431b6a40ec2c0c7b12f1c03e4488f1bb05f1f2e68a2f034ba54360f8e3e64246e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b7de3c712af5f658205d795dcd4fda6

SHA1
efbb2771cb2d49d7409b4acf8d0d1d859cb0c823

SHA256
f41fc940bf6de8373fec70857a98d931099d45e96d446497b69a81fc4c0cbfe2

SHA512
3428b86fa76ae030116380896fa9d0a4c896ce259706d1d3bdc3fa0c82db1868ba429317f79400a461fdad48552e6b646d3db47f344a1aaab61ae4531be96470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d87bdfc3874293f99bc22843dc56b4d

SHA1
e4b41d0236c4a06bd6253cf99a67cdb8ab0494cb

SHA256
337391cf42ff9765d3e88cb916bc7d031c61fbf98575a05ad5cfe1ef37a0d12c

SHA512
7e6281f66b1f21ab805ec7432f08c54872704dc244e68d554f5636b457a606d5387d7ecc0b9818711bb35685877cbd2bd5ef3a7ab3bfdf41295bce503ed5a62e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f2f891cb7da9254afb16695ee12d0d75

SHA1
3cbc1bf2593b91c375d5f975f2479f7e0b06a3b0

SHA256
4d0c8a2ec4b832dd3c6c3e641950ea956c186b5431eb9f71788a328777665a18

SHA512
eceb785fe1cc145f01d044450ee4b9755a363b4bb30312bb93bfbda8a7cf677c26ef83ad386c5145a5da988d7e227970437115fb2f73a6993043e41b007fe26e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0574db4388abb0b8cb7548a3bf41ccfb

SHA1
edad301209508020e17f780ac98df6d8192a9217

SHA256
653540bfe3db8c0d45da1bb6e257c4dc288fdce7dd3c75ad22a9c2b1b906b02c

SHA512
ce4c82e43f2b76dff5d8b13b58523b7d94e88a22a9ecaf9493623a32d442773533f46419c4eaa5823cd7fa1f4254e3ead4acaaf1ebefe795beb286eb9e8289db

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e0c9b1c83af4ba6aa387175156dcb1cf

SHA1
e9792843303985fe0bd2d2d83434d8349ea5359f

SHA256
0e1e8de91bade662af8d2011936b3a9df910602059ca2aabb63ca17d478501a9

SHA512
2f39dde5c1978afcf14aab403c9477591810ddff5d3507c2211aada4fd3e2ebaa02f1a0523e13b595c8f409c0ade2327fa37436d172f279788b5ddf88041bfe7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
f301cee50c920f7c8d72e65c56a0c946

SHA1
75100a5f12fd4ac8621db3b5ceed52fa1252d28f

SHA256
4b3395f0ab2d18a34b78147d1b52f2a0b9754e591250d1ec70a4445a22845e99

SHA512
e71c8ff18726501da37c280cb3ce8d80caec3415195b5f19307dc188852110620f788bd3094a5b918812002acb52de588b4f349ada85dd5d80169ce146588c9f

Download Submit