hxxp://drive[.]google[.]com/file/d/1-h-f8n3A62SKDsWlsujTc_3w0dtTWREx/view?usp=sharing

Analysis

max time kernel
85s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://drive.google.com/file/d/1-h-f8n3A62SKDsWlsujTc_3w0dtTWREx/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
15	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
4048	msedge.exe
4048	msedge.exe
3924	identity_helper.exe
3924	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3508	4048	msedge.exe	82
PID 4048 wrote to memory of 3508	4048	msedge.exe	82
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 4744	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	84
PID 4048 wrote to memory of 1216	4048	msedge.exe	84
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85
PID 4048 wrote to memory of 992	4048	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://drive.google.com/file/d/1-h-f8n3A62SKDsWlsujTc_3w0dtTWREx/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf1746f8,0x7ffdcf174708,0x7ffdcf174718
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7947251210579936976,2657245747724139402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
b1c2f974769c5f9c1b8a1d62ba8143c3

SHA1
49520e961ac0828b3bc30b864244cf28ead330d9

SHA256
d335c618de2f68f77d4306eac13421e1c47e70702d1410f4d04a1327708c63f9

SHA512
0826c56352a0590a29ea364f4d9c279a25cd6189dcb1cc06fe35a1e1178576a5ab3c102d3d430b2a0d9fa25a2b3d03b023cf4d2fc872bd7cbbb012d07fd5f88d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
6ab0e317d02731e8c9a7f60e9aa827da

SHA1
96eb9b88ae00e79ab56e75cf2fc9b57e5ddad650

SHA256
b9e93ce5da679d4dc1ea3e145f8dc8f7c642a7cdbf5bcb4ad83cdda5a1a7cfe0

SHA512
56c759a4efdf00ffaf45c0e604b5880bc8df33d63baca3ebc0a09c9cdd34a544827879b3b72e974a714e69038679f82690abe47fde6adeb0297475b6b04832ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
20065b161f35959ea520b192d4f602f3

SHA1
793c316d3fac671122e840fa5f7f43971d82c0c8

SHA256
2bd800d5d6ee71eddc2b8572409066e97be8f2fbaf8f503ad82f2aa57256ab09

SHA512
54740def95cb583d2028819ffc71f13759a1ea658618c383cf03e83f8f02e004298c7f507f942bf14aa124c581a965076c08f4b9965ed0c56302b7e52b710159

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5edf0f6031e075740712186334663a1c

SHA1
04aaffbdea6e8bd808447cbba25f667b470d993a

SHA256
4f331ab47833ce2f9a990c06067b6d2b9d35ba344024e27d1886133abc2b23db

SHA512
2cbedc3004688550bf7af635b89a00774afe507aaffc85b4a183304b482c12a18e38421a041ded8011a3f4afb509adf72c447789da2dae3b6945ccf2e8de7054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d4e3c82cca8e65684cbb1b8353594bcd

SHA1
98ec16dfafc403a81cf0b4902ba2f8bd4192ac03

SHA256
6d37c452ccc8cc18b84bac0146ff8e5f1428a33191cde8184ce81e23fc399cd4

SHA512
ae69f3b3c52e5e39f0375623c6849dd8b4afd0c0bf136e25d7956933b1d506dc2136cac850cc1e709baee3387a59e2d98484e9b9b23047a556e6e0858ae88072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a606dc5254fee9140dd924fdc4c2e8e7

SHA1
dd818c3678c555f96ccd4077f76032274454c515

SHA256
ef02d0cade9dcd1b3648fac11d298cf3f171e4cd4b95c37e73429bf79a675b24

SHA512
10ec7655174f6b839d42fce3f7d8908f8bd49fecf023456f0ca41f9efef2c81e3bb4f02e87802f05b4cedd8f34045c91d5318bb979f54fdb3ab37085f1293fb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f458befe941ea9db6bcb562ff55a931d

SHA1
041035a3c63b76c90dbe9ce66b09accd8ff17ecd

SHA256
840192fc9af4df45e5d007c0b3e2e54f6f3ddf4fc78c6b9848690c2f6dce95cf

SHA512
ab1b2a7c0fe496b400cb135875b2db718f36205b3c15d1a6bc9ac4a032d7e5f45f4eca44376f4a1b6f1d436c6929742aeeec7611087c64cb2417cd7bdc0cc1e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e5cc.TMP

Filesize
874B

MD5
073f28666f3442f356087e99dfdb56eb

SHA1
ef55ec99aa3a8bac79d57041cc0c28c48d81c65f

SHA256
e2cf93c9e49cf91da70bcfa4e5ff985d22ed89ae25ba0c08890ea3f71f863486

SHA512
231a213d64034d06f8e63ac5c99d48fed102e1dcd38b0f6c18463f6ae63bc23bc6ade049d5f25f12cfa77fe01c340b99c7761e32f0ed245c6a69c8acb138c351

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3369658fb4f2b02bc1c0e28dc602efea

SHA1
1861d2fb3289e212ab675b79c03a500c92475576

SHA256
51760d4be96eaabd4a12fefb9866c4b02ecc21193220e67844ce7480f9028b4a

SHA512
f60ad8ca7d47b0c3f0f81c85c57516f5bc7e57cf076786fec9f1175ddb8bda3e1942f747a1c7e82624c605c0d2956d188e0d2dec5b14c62cccfe4d9369f44557

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit