hxxps://drive[.]google[.]com/uc?export=download&id=1mHtC1mrhoQNs0xcgm2XuX7dtu9EPYac6

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/uc?export=download&id=1mHtC1mrhoQNs0xcgm2XuX7dtu9EPYac6

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: FRRsultattest@test.comtestIP181.215.176.83AppareilMozilla5.0WindowsNT10.0Win64x64AppleWebKit537.36KHTMLlikeGeckoChrome92.0.4515.131Safari537.36Edg92.0.902.67
phishing

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	drive.google.com
7	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
66	api.ipify.org
67	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2860	msedge.exe
2860	msedge.exe
4840	msedge.exe
4840	msedge.exe
1764	identity_helper.exe
1764	identity_helper.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1976	2860	msedge.exe	85
PID 2860 wrote to memory of 1976	2860	msedge.exe	85
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 4268	2860	msedge.exe	86
PID 2860 wrote to memory of 2512	2860	msedge.exe	87
PID 2860 wrote to memory of 2512	2860	msedge.exe	87
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88
PID 2860 wrote to memory of 4076	2860	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/uc?export=download&id=1mHtC1mrhoQNs0xcgm2XuX7dtu9EPYac6
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec00246f8,0x7ffec0024708,0x7ffec0024718
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2136401706551421377,17137928291774030308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4692

C:\Windows\system32\charmap.exe
"C:\Windows\system32\charmap.exe"
1⤵
PID:5172

C:\Windows\system32\charmap.exe
"C:\Windows\system32\charmap.exe"
1⤵
PID:5792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
942B

MD5
da6af9235a1dd0b562ecdd12af739293

SHA1
dfa0733cfa04bf1ae3b110c57def5d19d0251c28

SHA256
ec648daec3c602e007c0b7c0a1bb4dbdc445b3db37d31b44993ba4493e81535f

SHA512
6b0253deda6d93d289d1b40a9a10cc2ca75892145c9da8e404f6a468a78868073ffd47b7b9fa929d1501d37ec97994feab00be64d0ead6d48dd342008da2c142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
797B

MD5
2eb3251c8c34420d353b59248276dc6a

SHA1
1ca51ae70d691ca97731c3e98488167cf6b4889d

SHA256
03294f0c21d521d36ac9f8679bcadc06d7f81fa748d8bd36868047af44936879

SHA512
16dcc2efd2c7da69d8fc8fe9e5dabf01ad4cc03b6110a1891c3f434533e4efe8b0ed3781135a76067a8870bfd14d67c403822d47a885f371b15e4a5360737a72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
43b8be0c7881322dd4a28b5d122f25cd

SHA1
dbbd997d6d94557d08c508f27e5789635fb4ebe9

SHA256
2ac706a698bff6770019f51715caa6ebe133c6168a367e5b43a3d6f1d8d72a52

SHA512
367b676ee6bd0dcee2e1e96e0bc4dd25d47713b4188a4d3aa526b07001daf598e45b82fd4e96a4aa733af48fc0959ef800f147e338e898e7d6f823d356ccf7de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bae42872059494d31a34b36a09fbd57c

SHA1
06295c164c75c5660e7196353bd180b20aa3b57a

SHA256
afcd25e97a413f651463f1219922099ee44f5cf61667220ee2ec3849bbfd00e5

SHA512
f07353735d648bf92af1e651bfc15ea1db5df1f65d87a88f2d3d015c9b9116f19cf91e3af3d20d938709ca6a7137cc676acbfbcab99815ad3ebcfa338989a71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
534B

MD5
1cdec1c64112ce141c9e36cd03fba48f

SHA1
ac49deb7c498751f7e2d1e74aa10cd96d527a5fa

SHA256
73f2e82bd51e663f110aef7c81adeafacd2fa84134ed29f8658c6aad6a1ebd4d

SHA512
64dbb82549c281400108444a87e5ecd5db116fcd7c73ab3627868b3998ae98538374bdf0a582b485da144bfd7c87bc8e4de806d107877176806fc2363944fc9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
854344e675e2bae02df4a84c40208d97

SHA1
ea6ca2482707153ddc6cc31b477dafc25ab34b2b

SHA256
61546653b9843c07e13c48f918e1c8e20cd0c637a1591c2a9ea8009e258663cf

SHA512
58736798c2f0e31a4942ed5ba7930a89702833972c1b4c172f4ee6cdc58a394b2eab66cb8c3b03d940d49f47f08aaeff4fa814ad22225606da8de4f873d7b070

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f378.TMP

Filesize
367B

MD5
745048a51549bc75a5b7c737b985b265

SHA1
28067e977bde93aab16c454db5ff8df43b7e77ab

SHA256
91cf162a1233d67b5d835bc474050e4e1b85463e59f45ea0c5fa39e25fbc1ef6

SHA512
32d2112b32bed2101f0d46284070ecfeefebe61b16eac12f610cbdbf6b1172a86f9bd0c2d332ca0265f9e419dcc673c2a4242b3b118c9a80c177f77955dd8b5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4aa3d51df71b379dc2f1e6b73c029d3f

SHA1
a136318ea419fd26061eda07d59f0fe8e7da91d8

SHA256
5f16f4ad6a6808e8d19d519b5bc52c68563a980b056bdc2db0b8bbe18f94fdc5

SHA512
44e8fbecfd4dcec1a84bbbd88568557eade0f352791b98d0c5c15e2c488b6b558744bc25b6546508709e830774bba3dc7cfa03a5ba71239cace4bd249c756286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
87dc58d18d17b5c7fc31389577280935

SHA1
ef6b9719bb12ec7918b388e8e47bbcfd2190f324

SHA256
1bb4a8fc3adb6e5ec2f5fbde1dc0ca7160305f8c63d75539c07681600cf1d7db

SHA512
3aff02a55daccc3d1f6746dec22927338f2d75f695de3300f2e7cc06aac2dc3acb633865b7bfc70361ba38693e52518503441e0d6d05f3687f9017879ef95ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
50a938d5cd5c7bd8ef6037fbe19dd773

SHA1
ed8fac542434d5ae729feaab7059258bad42b63e

SHA256
3631d0276ca1a55feeede7cff06c726f91a753f685e9f78046c776d5df6bd83a

SHA512
9ca42a93b4716638f7fb056a4ba79bf80237b3820ffd5ef583b99c95c737cb130ae18e2dbf63c77f32c7df39479a0358b70f3884c6fdc468fafab4ea9ca35743

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit