hxxps://drive[.]google[.]com/drive/folders/1BfuO-Le-xlDPY_nfoWa4Aw1kzf6n4xlA

Analysis

max time kernel
207s
max time network
209s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10-12-2024 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1BfuO-Le-xlDPY_nfoWa4Aw1kzf6n4xlA

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
5	drive.google.com
7	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
2876	msedge.exe
2876	msedge.exe
732	identity_helper.exe
732	identity_helper.exe
3172	msedge.exe
3172	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 452	2876	msedge.exe	78
PID 2876 wrote to memory of 452	2876	msedge.exe	78
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 664	2876	msedge.exe	79
PID 2876 wrote to memory of 3836	2876	msedge.exe	80
PID 2876 wrote to memory of 3836	2876	msedge.exe	80
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81
PID 2876 wrote to memory of 2988	2876	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1BfuO-Le-xlDPY_nfoWa4Aw1kzf6n4xlA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa0a1a3cb8,0x7ffa0a1a3cc8,0x7ffa0a1a3cd8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,3115274954906947089,17130407099488345152,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
25KB

MD5
ab77c85aab42e61d0557bfe285bcafc0

SHA1
ac4241859bef658513fee5ae997b08543b8029e8

SHA256
32a74d447d992c99982a6c6979935c3eeffc358bcbcf7b1843ccb8021523f398

SHA512
41aaeb6c514f1ec1e97e213739ee2f4cd731cfa17fc1bd2c0c2d6197eaa487ed4b57c8d359ddaabc8764db4e12d3000eb2e23f884aa5dad0962ee9e0ae1d02b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a028c15f1decb3f07d6d4ec6a6779e12

SHA1
f3dca4cd50f43a36b074d33565f12a777e1999bb

SHA256
9cdef1a3ed6f49d156f049ecdcb4cf33d0eca2625c0b5fc676e3f99cc480eb30

SHA512
d0f2d2a8d58479fa3407e267567cfba06109986fc36a417678b9d318fec8e9bac5187feca7f11c18fd8c3b3050ccaa2559d212a164b32d8d29b101264fde2cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
62727713c1905edcb2d1e72900877765

SHA1
b86212b1ab70fdd420c1b08382a756322706aedc

SHA256
0d0fc8d895d3e3f34b2126b0c804314f9cd00d4d251d9e573be28a4f5e5c330b

SHA512
3c5bba5b57f4c77553525302f77affb34088b40c41e787a1cf65df63eae8802a7d2fed299cd200710212efe1b779ab4a42af8d1bc22773b9555cbdf9afbe94a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7ebe77776e03935ce1d5f4d9fa7969fd

SHA1
f914fdab1927a83a6eb6b6a8e7ab941520c4a608

SHA256
feab78202fe9e32e7747303201a5f3e786e8b12c75b8ffd3a7d8790572d27a16

SHA512
7c7144c616dc98d80dc1fe24102079caf841f474196fa36dd34ae306b8931211d2a6750f791b986859c70c6dacd92c84b4f2c237eb889586b321ae0d8ebdb785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
07bc93c6826ee26bb156c88840f73f7a

SHA1
e4d51c38d72f42a8095742c0d3e89a39891ca0de

SHA256
2db53f7c15ee3b445fb1373cac89513c8fe207c92846e196fd9c94ef8d81ae63

SHA512
d6e4024b2af6885cd0445556f3b33caa97803f6b6ac550325c17aef94797f0d5590bec103a6c1c5e9e45617dd4748c6b502f303b5ad452a9fb30437909fee675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1599f47f9e293207509d71aa954d3d74

SHA1
9f6e8c68f480fdd4bcf7f09162eef5b64667f3d2

SHA256
88b48ee5ea7b5d0c299a842ad268132ba76add21154be8fb5d2d39def4a57dc2

SHA512
453b5cf5793ffef60db61fbbda1a7aebda6d2e84511692874997b149bb75f48b72ecce5a3124a622a72d33fff70ace2974612e4b67ce8202e7718ab1c48da2c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
043487182fa75858748cb1917d328b36

SHA1
989195b788c48538e148af82b68a6879e82f33f6

SHA256
ab53e98f6ae07e8548d6d69e7e955caa0674d2c35fbf0cbe885879464eca3156

SHA512
e4103fcfe7e348581daf77c675adeaa23619802f63b127da0424ca5621c3aea2817e260b4d3d1c55784a5ed9699de821b5c84e8cc65d1a44d96d7d7e94446b94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
830f6e315023fac8420eba3843241fba

SHA1
8a536e1ad30d1f7fe82f40c7379beb675045d0b8

SHA256
1cdc8cf644e82fbeb4a194d5e15fe7a831c6bfe639b2b5f041f339010db9e148

SHA512
9e56ce6badb1abadd9fe6c69a5d5c9aac43f12b8c734a69c1be467760d05e5009b4ec0ddb162b880c25a17eed02eb054edb52c2725870c96288aea794be2303e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9cd1f3af8d9f758f91abebdd0cb1799f

SHA1
fd2a676a47d453b76b2e9b4cd6d7aaae6d1c3031

SHA256
fe8a0784f62b7c67cdf2ee2f1ff0e4dd24ca75c388a406b005b7577c24399b9c

SHA512
d954d44e72f96b6ae8f628b57e03d0906b780a181f6de4edae230f5ca17b71d9c2c953370f512cfac8d5f185e0c0bc51492939a47dff6548501f5ea688ae80ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
74312808fa5684e0dec48ff26910515e

SHA1
dce28a8e2a4ae2a35c64d4284b16b47323af9714

SHA256
d98d68283f09e44a477ce93a69f440457e93da2636d015913be3ef9a1819bb76

SHA512
6a7020c7ebb5897c068382f692c3a71c085115075f4101a217d7fa9a12b5c4cf0ea2703d5f962b48ce326f274340597af2e6f4413f261066b32b12f783cc5ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a4a6319068ba748f4b46a39113eefecc

SHA1
282e5092cbb512d98967db1a736f5e3237148dbd

SHA256
a94faabcf1a7c1a883e7620578a68ea06c9ab1c254729750b2b5bf7b5cd7078d

SHA512
0b9b972cb63c7014c76e132802125f80950e780c782b9b342aede33f5ca77162a02cbdeffe56e24aa6a4ea9e6888fd3e81037fbdcb506a55ab1478fa86a07e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
136df1cac2d6b49c32b50919fc4e8f2b

SHA1
b3897daaf5a63dfd089a7a3b04a08581acd6fb2c

SHA256
90f592221f65ce93a55a97d0d08319b57aab1844a851f792dcc4e52bbd28fc53

SHA512
63a7874d6a3eed72133c4d9d2453186e643794275f2f4468eaaf56bb07049ca16275037379cc9a0354d670e04401b793ad839679e4a9e3622e7aac62d6cb67f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a207.TMP

Filesize
1KB

MD5
9c268a210f5664da720abbb9d4c9e316

SHA1
c9692f2c11f97a2a4eadb16aeba68a0d48bc654c

SHA256
181ceed736a1d0a16dd39b6a85ba57830495554b2d5066553d086c5261d9d868

SHA512
54d054780be0c1ae0e4ea50c693368ee631c331859d9a589500213a92c94e062237f4f29c5de2587287377b436eb964d04a8b07a1ab39f4142db3e29b4d1852c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2b726896dca337750d2a34ed48942710

SHA1
512c504f4ee6e78e986b916c7bb8915638d4f9ac

SHA256
5a8ed974c77e850728baf6c55ec78e0f21dea3cb5ecc7df32c7b964e2e804da0

SHA512
a7752e40099f66260966299b035119f3b5fe783668aa9a1f2554bd275cb5b995d2e1f6a11737d8ed408bc219cfd098e6d93ee3bd0818e9519b146c2a8b75e464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
82c84be920f9e9d0f4a70bdf1967d94c

SHA1
47e442116e3ea0ecc462de87c70a8cfb0622ae5b

SHA256
8230f7ca093cdbf32647a77061e3dde144c8f52e957e045b010fc7673b814ce0

SHA512
cb8347461b37997bec5fdd8a75b6fbeeb831cf6d52408833feacd52e336fbdf2896e2d7235b1ed2df4a7b81d41dac610514dfd2fa8e1827d2afe1deb99305043

Download Submit