hxxps://drive[.]google[.]com/file/d/1rtbrZWFAbN6qX8wnvjhhxLqS7fNIum-E/view?usp=sharing

Analysis

max time kernel
251s
max time network
253s
platform
windows10-2004_x64
resource
win10v2004-20241007-es
resource tags

arch:x64arch:x86image:win10v2004-20241007-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
21-01-2025 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1rtbrZWFAbN6qX8wnvjhhxLqS7fNIum-E/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	drive.google.com
13	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2988	msedge.exe
2988	msedge.exe
2152	identity_helper.exe
2152	identity_helper.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1600	2988	msedge.exe	83
PID 2988 wrote to memory of 1600	2988	msedge.exe	83
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 4816	2988	msedge.exe	84
PID 2988 wrote to memory of 2520	2988	msedge.exe	85
PID 2988 wrote to memory of 2520	2988	msedge.exe	85
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86
PID 2988 wrote to memory of 4924	2988	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1rtbrZWFAbN6qX8wnvjhhxLqS7fNIum-E/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff63cd46f8,0x7fff63cd4708,0x7fff63cd4718
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,18021951748858991792,13989199724454434260,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
49b41108a506f0c8145a02a8a590cc08

SHA1
0c8809a0013dc0cd4e8d5bfba27679bf65cc839a

SHA256
7d85836bbac36d4e08e661a258b24069c44676831cc81d83d3b968e174dca796

SHA512
d27561c80fbefa0c6ea34bccd9eccb123d2d749c3485de0a846cf8a00085b0117ab5aeb9c03b9db6e00fcfc6ff3f7b9a407544261dcb9777bf04957808d1e200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2fd9ae00f2672857f508849759e66368

SHA1
556a3c64537572b75294693b37041448c7b41ffd

SHA256
e024678009c80ccb432c171e1f32b4c3755d5ba3aadf89e9340e740bdd108aac

SHA512
939a3ba257eb8d551daf7c3b0cc8ad3b326cec1d22002527b7d83a708f028c2f769dddc38ff2af1eb7bd8a5e2bbdbc46be123efc77fa34e18a9691d62d5a8f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2700e798d01ca138e475f4e87097d18e

SHA1
80100667cf841f3e6b369fa00a67f1ee23336633

SHA256
c35c80a91dc499ca09837850ac95aa91493d21b9f60713e76a507e258b3e9bbc

SHA512
886fd504b33fb34bb56ddac98e394a848c8ca3faae2ded847688ad5e984b534deebabb126f09b7da7aae3b6cdbd717acf5cb440a20a11d5bcb432e3f0fbfe88c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f78c1abd113f292f99abfc4fd982cf81

SHA1
f5050bbbbb45d51e432cee0cfd1c3deb3570b363

SHA256
e43b2ad8c5850aeed5a1fb8ead3f3f0753fc703ecf843e3a44d11f0c7ae7025e

SHA512
5507804286bfc4e0349eaa1309237444ab6d4e85ef99e7b46bcf1ca9113fe59ebef3d8c9689f0089f982b8720af6e3bfae369daa8e6a73b34c05275800ff5e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eee722ec4bb48d89c088434717a115f4

SHA1
c3ad7a36e5a2772f27a743b0b9515a042c924193

SHA256
f82029d7c6e9a9c7eb7c8dbe2e50476a8061ac7e16be0494d53672edf4b83caa

SHA512
cb8d4eca18371d28bf551953ef44e9e59d0fecd0e1dd36c4b6423c56bc7a63cf9d5dd4d9f93b0bfe18289f7cd544236362a3ff7f6d92b3a654436dfe7d04279c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e4591b05d7629f30b6b5c0065923b8b9

SHA1
7fe9ef4800e2bf80d1c905a72e89f57df47397b7

SHA256
d32d7361eb7030313b1d34653604c88bfd064ccf0ec46dcb1cc7cd60487689ef

SHA512
0fdc1053b8befbc4777f9f65053ac4154ac8e205acd2d3a12ea738c31474a88ff555bf4520031ad48884b2de14b2382c000d744d009972571089e8aaf6284132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
7c04f18e7a68c97ec65edbf2c6044a6d

SHA1
e0049c1d9cf50688812dfa8523742810b41b1a2b

SHA256
5e5b98d086b0cec9804bca7d1757a4593c944a1bcc84c29389ef2874f901a029

SHA512
4e3387c42b1b16822f2945e954471494eae8e2cac8f93ab1f010213919081e9ae3c01484ad6217ca291343053984c6d93b8e92421790fa405b38c4097f97fcb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
f0a71a09fd776e5dd3d5353e90ce10a6

SHA1
1ae2db2052d7142973923d51cdf6ad891c99a79f

SHA256
13e3cc269610e1c24ae05d88392d3e2837d11ace7b01acc030f683b3fad0814f

SHA512
613ec47272628134bcbc5349dab2d1d143fec01e11701b933b461abb6f7591536d18b72608581392a3e69b548dfee55d5193d95697238bf838f7f0a8d076d305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
a1aadfbba666d8ef6ea331adab5604eb

SHA1
fb1b4c1e7ec7f5c57f6074ac55a415c4a8a32c27

SHA256
7ef61c5cf0d686a5fa392c0ddf21d4465f23d95403bcf3bfcb64f205d7ab97cb

SHA512
18bf6477cb9c6817b94034b1d97f36fe71edc95e67180a5e00e7637de8ce9aa3ea4acb4524699ea375575a184f7158d3d6d7b8ddc9eb76cbdc13f81193af15c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe65da8d.TMP

Filesize
873B

MD5
835b03d5b19e31aa8478e7aca8e64e3b

SHA1
bd213f35341f9847ed6e9c96f3fd858717c2df8f

SHA256
1f1f9f3dd570ff70a16f5da15b6701427992548a582975acd0798be51b40f7bc

SHA512
41bc4887189a6392c690aba991e165b46ccc7b1d9bab8788bc060218447e05812ae5d6760534fda4ce3d627cfd61ad4136402a9443dfdc215142693647f41b3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ccdc357a0a910c316fe54d5bf970a740

SHA1
b36bb57e6ee4e6fc7563d686cad73221d4b505af

SHA256
3e9ba4a57d17cdcb3cab66e7c72998d5bb785021787b3c74a660313f5f333cd3

SHA512
fe68a22aacc6b85a90e64ee7659602ab2653d42faa6647d40f6aabc318b43b4a48a202de909dbb904f48216249b600e8c9e36d18b25eefdc6871f67624f75530

Download Submit