hxxps://drive[.]google[.]com/file/d/1YbDlEF9w6Tj-sy02WY9QLmqKLME0Qnqz/view?usp=drive_link

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
28-11-2024 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1YbDlEF9w6Tj-sy02WY9QLmqKLME0Qnqz/view?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
3	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
2052	msedge.exe
2052	msedge.exe
3004	msedge.exe
3004	msedge.exe
656	identity_helper.exe
656	identity_helper.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1100	2052	msedge.exe	77
PID 2052 wrote to memory of 1100	2052	msedge.exe	77
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 1988	2052	msedge.exe	78
PID 2052 wrote to memory of 4580	2052	msedge.exe	79
PID 2052 wrote to memory of 4580	2052	msedge.exe	79
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80
PID 2052 wrote to memory of 4436	2052	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1YbDlEF9w6Tj-sy02WY9QLmqKLME0Qnqz/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd11023cb8,0x7ffd11023cc8,0x7ffd11023cd8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,12080853333814284394,8347553685259765550,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
96b84f37cc378562ff3b05e8faad6a04

SHA1
db0f7366e1cbc5976ebc4fb1d747d818ceb6cf7d

SHA256
484ffb577c27291f87f93f7d615cea683ce503fe882443a986980fcf4c79afc0

SHA512
d83ca4836394a624ed990c4b8511853d8d8fda9ef36e133501cebfef694e4f25c74a40acff9cbc45923d0265aa231204fb3f5ebc8ffe61ad880478a3e543654d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
760cde0dcf5db04d22b88de26bd84765

SHA1
a5422d9d527292a4706d5787facd13c65c43185b

SHA256
afc8581622b89929120ec73c5534200c525a94b9653357ab2919683ab7f975d2

SHA512
f92b4976dabf92767b2f64299c9246625e22120ac10427524fa6d1ace323db311aab89b152828eb956420741feec68e9267d075f9dba06b0cd8dd0d87a367c75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
879a2250db76dea6442410fb83d5ac92

SHA1
c93249cc52d2ce0e7e22355ac9dc5a1dc35a9f65

SHA256
008f12d468d4c6f1d939666e7e4717629446cd691172d49da411e922b8f0e029

SHA512
2664ff5108217b225c7f6a98b1de7b99dcce9df54f64ec07506c34e4e0ee97f55dd9680cb31e00018c9472fec7b811f26a94d27a231ab31d140f8afe5e5f2542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
933df30fb82f71252e9e901578780824

SHA1
28d9ba12feaf98da03e535a635b0c96113090fc4

SHA256
71d354da130759bf06d134ad05d3c9447e1c65a3f7e0860eef23a908dec0837d

SHA512
b8f1be73e59b5318e1270d44325d8103aae2cbab495352fb4fb9a8ae4983f5fb12de47bebc2d0845f0025796e920d4b4ceca4b1243c2d97f62e9680bcb4e2efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4fb9dc4ecc973cd724e9db8fbaf28199

SHA1
4a4da9c3fb5c67312efccbb1acbfb4f56548685c

SHA256
0a265aa700a15d67c31cd23c305ff1b6a01abd7397282615970bcabb90cf7ad5

SHA512
04267888373277408633c1b466023a52f82f9ab1f821b382c4b7687876ecabe61790b74373f644827089db585a23d04f9e9c952fe51d6feccb5c8d6a47662bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c1701ffae7dd26d591b3b07c835ddd03

SHA1
ca6f84aa86ca817af8e030bdf50f1613153a5068

SHA256
9f2b5981f3f41a0f9e11deb1dac2cd5f8e30d56fbecb930579d7b5c42825b443

SHA512
284d255f2ec163ca98c32b14590b08953e55bf5c579536ad3e38bbba3dce70b811ce70b829d63ba330a4d3d092018cab1b60b000ccd0049b39eadfb53f354c90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c509a5a7e7d5f683dd15158a1513b29

SHA1
f41a09af3cb0ef2d189026572dc1069b42109e22

SHA256
1aed810fdb87e48cbaf910fddef2eefd4551921c2031e29fd32370947dfdbf86

SHA512
0723ed64863a3d5c87e1d4f5214ae577119481e4454bbd6e037215b1d35dc2157f5f070bf5ee6c6504e3f6d4900bfe08a65a7150e4386dce88fe38f80d2f185f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
627f5f2d31f73a81b6250516f61b140b

SHA1
f5bc454cb9ac5504cd3649194965cec56afee299

SHA256
8105e1d9033fb0c891690e9262214edf895b462224f8854da4a3d3d1ecdf77a2

SHA512
dccea420ee83c1847a995ff23fbe4405b2c078459174c1a306d0a39f80b3068e8a32b04ecbf56b3f246214ab049f3ceda3e54eefeb25501a908caf27001adc13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e6da47917fe75780b0fc461bc390256

SHA1
88d88946c49b8c9b65aade2153e103d66f194479

SHA256
9c8464367e571e58673bd7e273ed87d0bbe92732550d86c85adb0e20e861eb75

SHA512
4d6235ded943582a0bb33458a975dc74095e0e6027b5acd0a6a8e424b424babc68bf93451f7515bbef0e5b5b553ccab3e49ac6c8db721584df176a26c16acfcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ac0b9d12dabd8994b433860f1d9759ff

SHA1
47a8ed585da2510fad41b09aace81f8a8ced1fba

SHA256
771029d89457305352c1c5cdf0efb989106836ff44639c923aee4d1777be3c50

SHA512
f005b62f98348eb3d65208a96bb5fa99a5275260fc3ea264334d489c77815ac4207c10a014b0cd0c1d195dce007f6721670ce35dd765e5e2d96c663d12f71a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
7e6e02731e0521827483f4c3e12bbfa7

SHA1
43cad2ea756a8441c7d04dabf377e444484833c2

SHA256
d68f82da75e1c61ffe574b555e6aa5ea83cdd8dff8bef62fad17c30a03967a13

SHA512
83962465d400f07df056513e203dd2973561c65bc9930388aca3666dac7737679c565c88581723c67d7c049fe3d91fac9bd5ea686204517b97b5575774e23132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585704.TMP

Filesize
203B

MD5
7e8d95e0ab9dfe488fd57c7a3086d91d

SHA1
0fe1a227beff864eb8d7ab7430b5f478931eab2e

SHA256
ab2b8343de6c721d5c52e8b9a11ae240e07964b6fac87018a5da8fa90c5e6689

SHA512
2a965df9ac044c120bf8d6c524437487a68f67603adb7202baae7c4b6e617b719231b8ef809a0f48580c3b461c7b421386354731defdea5091562ead3bca03a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
86f40f5220671112ae96a0a5e319f9a4

SHA1
48fc54660b4b5547490e5dd849000b9802b87e47

SHA256
820081471fc4a26e94ccd999970c8e15031ad526942a298cdc8b2a32c860fec5

SHA512
1c358ca1792322e4b406a9410b9d8edff80a224c4235ba92d2f67e64d44fd9600eea13ea0f4e4167ede8eacbf086f7df6bd7172e00dfd58b6b2d0f6db8aa6588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
17153874643d9f2bd3cf8a9de73f11ed

SHA1
eadf3c2a5abe36315d28f63c21aa3ec91263ee91

SHA256
e28a9ddb3e7b8b456dd10b86395a4990f37c8cf398b34935cd3e7094333197a5

SHA512
979f7f57a1a343eb7fc716ffcb1e1f7db4b64f154b792aecf1be06aa60a4ac63b263f1552c091fa6c6e36bddd249100bd45c440ee7709b67b86ca7c2d5c29ca8

Download Submit