hxxps://drive[.]google[.]com/file/d/19CBI8PSnpbc0ZPwJxkeqKIwTDasMcw4h/view?usp=classroom_web&authuser=0

Resubmissions

09-01-2025 08:42

250109-kmhsasvmdt 6

09-01-2025 08:31

250109-ke6jdsxkbk 6

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/19CBI8PSnpbc0ZPwJxkeqKIwTDasMcw4h/view?usp=classroom_web&authuser=0

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
11	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
2344	msedge.exe
2344	msedge.exe
4584	identity_helper.exe
4584	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 4708	2344	msedge.exe	82
PID 2344 wrote to memory of 4708	2344	msedge.exe	82
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 1660	2344	msedge.exe	83
PID 2344 wrote to memory of 3432	2344	msedge.exe	84
PID 2344 wrote to memory of 3432	2344	msedge.exe	84
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85
PID 2344 wrote to memory of 1704	2344	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/19CBI8PSnpbc0ZPwJxkeqKIwTDasMcw4h/view?usp=classroom_web&authuser=0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfeac46f8,0x7ffdfeac4708,0x7ffdfeac4718
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7086633832182809637,4043980139008736469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
24KB

MD5
2b77b2c0394bfd2a458452006e617f96

SHA1
11eff89a8e3e64401818f81a02bdc84e8ecc4325

SHA256
c46f001852fd8e16bb731f21cadcfa0cda8e7d064e11b0faa18d6bb8325acb1f

SHA512
21dd89b9d6874539477e8b8dc8d98877c86595a8b0b8deb624547c3f407fb41550f65ff744c22f25c574994414a28e73f4d0794c5bd49be890fdac7906f0ba30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
961e48dce4ec3cef37ced411cc1dd7b8

SHA1
e5a9b5be7192494187e10d3af2bdc6e51d92a5a8

SHA256
f754b898c6b81d30dd29b4f4266783782135e16fee939e2b510ec19615c761a3

SHA512
3fc6266a6c76330d16ea778b23d2d75992b029aa9a1b82bcb665820cdf6fe934d44d3ced0fc7855c34a03f9e78c7f6d3306fca1accc885cbe17739efa3713fc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
9e5846bc7455938f6f27f97f22047b06

SHA1
dfb4e284dda91e6894a0ec924e75a4a51f4e8aba

SHA256
ce5ea575e0931c3bc18096135e340d3a4d75f1bc560596feb99597afa6b77ad3

SHA512
5eb66cd6d706090fcd35ca46048d5a1331593c83836d965e03eb494f9d71671f305450c482df6356b0e86dfb393b3670c59409c477016bc6eeb07a43094b1dd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93bb48f3cf47a5b13028fda6cc1bfbda

SHA1
10ca8fd1c050ce3b375a5590040739f4f1b33a1b

SHA256
4921bccf4af20527c27a4a025d5e95a34eefc8324dd35a041e857259adcb6a21

SHA512
41092cf75384f4fa024e98dd4cf1af86d307b2a87e3685d31e9a89bf5e6ffabb5e2488426cea0dcd6b6eca3efb6d3e92970ddcfe573dff517db4434306cff9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f75fd463166772a488d3d026e9483c91

SHA1
8c8919d0e9ed1f4cfbccdc5d5b890f1f72f9ca31

SHA256
259eb7d64b82c4d1c94e6e7b73e150a1ea551c521a8bcfa010dfb25839b600b7

SHA512
eabe862f37f5189bd49074623144ec932a521f3771f215b66f3098fe2748b46a324a6142ba8d331cc838c0e34797f5715411b81b748d0726d8f3d1634498ddaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
434429cd4e54d6ad6dfc24609b292218

SHA1
f678cce775368c59450dc5fe5bdcaf24f6067ab7

SHA256
53ae616764d684f3ff014f4b06f3feb9abf49e82ba26d8a471f718ad37bab740

SHA512
8d64576ec596d10ed0e9200b585cde7db60d8cdd2db8ed7db26c3e23582e2e93f7210564a7f04b659f122d2b380fe1643ed4515f2f42f4d165541bd14f355a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
82d95c75fac6d1c28fb7795141ade86f

SHA1
e88a56c61b3d2f01be0786695138cf92dec3d4b2

SHA256
06fca880209155f3f9dad39b17536dc88d6d665919bacf9022fc313c1bec0a01

SHA512
c29be50f4246a81750c4ad7e5874d97de82f18465270284ea83fcfa16a883ef002c2199c9787b4d3c05f312686fd17a31e3da848824a4f1896fde5706fd06ade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
036f56ee3f75d7159d05abc751478b21

SHA1
44f3bb6943ecc7d63214dea9df8128c5fdfded06

SHA256
fdeedbe97e05f2e9fc65588d508cc63e4ba221a2154f42871eb4277d8255f374

SHA512
7c2f6a9f74a03204f2a988284b2e40b71c5be745e6e9ae6f71c21d9952c182d7ed91fbfd01e6988623aacf419d9ff8cadd4e9e20fe37fb9d8a70ea77613b97cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
921bfd39aa3a5b8838931d99103ab8a9

SHA1
b718392566fa76ec7a8bbe3eabf28be2361366ef

SHA256
aa75f3459c3197dd123e3660dcbc4f2d00616af072a699ed43496a8fc23a88d4

SHA512
d941c92bf6e0acd58997ae56999bce1ea4fcfb59d83e50db45b4b7072c2761b86ca018c78877d4086dd848fd6f603d5a58139c1d9523d606246bbad0ce4127d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b50ca97b803daa2883c50aea6fa91d00

SHA1
76ca69bc1c183828caf9f4ec039080392dfe9132

SHA256
927d0c053ddf4e4617564575ba633f71160c91eb75c5e4f0387b1fc87a23bb68

SHA512
986cfb7f3386a69ac3f2d0c0b366c813f2a1a1b9ff2506db731e8e47935ed68eb9619f819531b9b569a62df4ea92d04aede17d2f4a32b986751fb89f138dbb65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
df6f54046316e2f618bc0f642eb29cc0

SHA1
c2c81cd4769dc1b94a352b2f980075c0b97ecfab

SHA256
d65f54dd7ca430d6b36d00108436f747cc03788b67a114e043fdd469bea47439

SHA512
85cf53e73827898e448be4ee8f98699bc68e510d4038e44ed01ddac316d6ad5148de13dab95e76ca9657c203d7c7a0154168467f63d968c4cb4667bc89b515af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a88.TMP

Filesize
203B

MD5
1a9ac63e30ca7a48d20bea161466cdfe

SHA1
42b4354a0b4adf128ac4492e6641207301e3c6eb

SHA256
b3e3101bc32028bebcbd818874601ed67bfb27ed1ed261824964ec22c0b7abd1

SHA512
902b79ece010f1b2c59ea59cd4e0e342d442b9c7769bb88e6fef6c7f902e0645130bf2af3362626e09e88e76febd15c3b8636957595c2e68dbd6e3b2a18696e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dd451a47939909a6dd626cae0322d5a6

SHA1
3fc7e1376cbe0b7437bf5e1f206b6752466ca93e

SHA256
78637a2615454d3aa148124bb16a4aade09363cd0098bbdb081f4c2b457a466e

SHA512
57780d17d9085468c9650715526a1a731abb002a49aafe10e383e56eecf8b4d80bb938f1655e7aae866d12feeb57765f6c3dd6ad9cffa67d54d549946d025942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e5477c98135d50006ee1e619df190272

SHA1
6da4270325725bce476b1a34ecb863f99595d39c

SHA256
cc4526b77b4c7daf0f5cbe90e7c4e9ceaf229e7b472d132365ced18f81b91526

SHA512
e096eb79a7c3ec7b113475b06c361a890ddbdd223969036cf079b4fba0780bfbf62d2972c63aa3cd8f85879bdbb771e055ae8d3879ef2a1bff1484b23dfd068d

Download Submit