hxxps://drive[.]google[.]com/drive/folders/1dJ5WinlbPT299FQds-HgoaysxfKBxPqN?usp=sharing

Analysis

max time kernel
900s
max time network
844s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1dJ5WinlbPT299FQds-HgoaysxfKBxPqN?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
2452	msedge.exe
2452	msedge.exe
4492	identity_helper.exe
4492	identity_helper.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1480	2452	msedge.exe	83
PID 2452 wrote to memory of 1480	2452	msedge.exe	83
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1836	2452	msedge.exe	84
PID 2452 wrote to memory of 1468	2452	msedge.exe	85
PID 2452 wrote to memory of 1468	2452	msedge.exe	85
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86
PID 2452 wrote to memory of 2656	2452	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1dJ5WinlbPT299FQds-HgoaysxfKBxPqN?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa57e046f8,0x7ffa57e04708,0x7ffa57e04718
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8345199674671975284,2270101290886111765,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
3308ff788c0568509b459724af64a197

SHA1
e360d2b442cc4908a4e58f9e4eb41c2a8526ea78

SHA256
7f264387a8b64caea14a70666b7dcd7dfcd873538a39bce76b8f38d8117fa08d

SHA512
a05914d03d74725f2c505873e4a99a1079b064d5677678550f12d68b890ef652878703658bc516c4164d851c8898ad69b72a5c1a482a7e3afc46a4ccde9ab405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a0bfc31e98203e9e239c11ec815a968a

SHA1
f31af8578892b137e4dfa7cc7b0c097625b6ed20

SHA256
37342195ff898bae94f3108f1167a3a00f3cb458f81983c2636c47b71e12bb94

SHA512
02d1b2ed02e5e009f94d0f3f67a36c98025359f1cb5daec65fe43bba83322f820c744ac09c7de697ebe4689b4d6365695ed2e15a3b59a5264aa6a77275ea0dc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b328c3eb3553c95f1889dbe8f7fbc759

SHA1
d17f41f6c3db0f30198b6afaf67091a2065e22fe

SHA256
464e8ffdc80c797a29c1f129780ace7160c725355bf90e1ffd24b42c85790073

SHA512
c7c2113e4542d91f9c75a3c9f86e5898c9fb19bdc25e3e0388b472725397f06786310591b7dec66761b135584560e7b4d8ae5aa58458b0315c96c8667f19be3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9bf5e7fecac226cc0fb3c5dcb265cdec

SHA1
926372bb2431d5fb173374fa400712e2321254ab

SHA256
b2de18319b7b3457628e69a388195c285add4b8614ce70c3dc2ef9a1f2f9aabf

SHA512
ad811605a92aa7e1660a6d49d2ccb446935a3c51e5d7b9dcc84df4c196dcb6131a00e5622efd03e0d19ce00bc4919ef93420aacb051728d9a02595dda2644291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
96c6ed1572c2ac43511b92234ad3e582

SHA1
cfc1a8fe90a6fda5859797f252fb13433bb41685

SHA256
5b61591293513f7089cdb7b7b61677756bf1a48b7a68b6c6a9532ecf710a1949

SHA512
e4928fdb29eabb25a1aa9e5a70f0b41b27982fc54df07b147b82806eb593fa22e87777848d051892b1bcc4157295efc8b8823b29004888f5e557bc0316afd356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f48de319db92bf087fa85cc13c4fc785

SHA1
81d32ba3e5744b8fa4e768fcd601899cf0471e2e

SHA256
c9154681682c190ccbe2eea6a855fa7da8ff9b6ae2b68de13798292370bc4a95

SHA512
c9ccc0e211bfd22e93f980284888d5d6743f6cbdc5f9612689155ffb6a8442a4139056eb0bb140f770f1ad1193c179e9f0b9f299259d4bf351f1c1646467662f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
17c17b9c77adb8ed93073950b0f0dede

SHA1
7b836758f8c61d702b43ae479bb4e292358091bd

SHA256
acaca96ee576c7a2a3f30273fb5d6b20752cc68dc5c47998a6e1b155f3ac81d0

SHA512
ccd307d67766c5e3b3edd51394efe4482cd2ca018fa8951a3fa6b092b88bf6237050b8aa8f10893480d81b68f7513c54dac6c2e4beae47f6d90e9fd6434a9cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fac9f3d3b1a7a1414b377b4c4a586e11

SHA1
1a9ba199fc0049bdf8a112a86f6429fec5fce9e6

SHA256
3ae432da813d9e90af99a55b5d592264990d68bdea1b7d0ccd623308030fca2d

SHA512
ff3b7307ef0f4125905c466704c949bcd4fdb7d7a5490e5879a8c04f9e952779a15ba78efa66c4528fc05813e186a4e529c257c64cd5797e9d0623ed6b158d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
3541c48c97ebccdece6b289a57f96101

SHA1
d84e8d73c00d7b4d81decc5b374c278906dd29ba

SHA256
450358cb0c09ae8ce79b42bb180a51b0576514028accc4ed64c250343cde1d8c

SHA512
54b470ac8f922cef7ea825f6db450ba54eaf7133a0a6e58542b469a92f9e9d1b808f58ee9c2bffc23f159f9ef1951e67306b0cee8510a19094d2c240bc760775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
f2e1acc48debcedf7340932c6f5c8fff

SHA1
d716379c2664f4a8d0ed1a80802b2dba4a57013a

SHA256
fb3d33e7b4578198e926cb78905f4785ddcc9cc0e0e32e504829c52a45ab4aca

SHA512
f0aa78941c3b69801bae0270e14c12f8e7ba1107c735253d523547e68614323905fb4c97912223b231921a954013c9081bfbc5175f2be36a4550d07e8ea7316b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
109834924fcba5721930ae5ae2381fd6

SHA1
1a40a1fc7240daf22538f632e9c310fe50c785ab

SHA256
112adb97b40c98c2252f61a87b3591236ad2e6151bd41cb417bc9b7c48ad0646

SHA512
edb8fa973e4a1314cbe3c6fc3d03cb36d5494946f7eb9289dfc8080fbac30577d0d37791e1f68452b59e1fbcba1fe14ee07e6ee4811b916958371957dfe4bf4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
282ba137f63859c80f417c26ae84a04b

SHA1
c9b8cae8e5a9cd2dff1ece8af0518af88b2c848e

SHA256
8d5d57bdd3d10df8da75195ead71949a51ca61bbb57c4dd0e38e273d8e52c170

SHA512
680864b74ddd29eeeded9e8605f1fdebc0328b50b8845a0a37a99f876f99e87e0574b4d9c8d69f0824b4ab382b2460544c035b5c43d250aa09cce9e7d7f41be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ba62.TMP

Filesize
370B

MD5
57879130005a65a5f28632eddd8dc996

SHA1
347a90bc8b9f43b1111ba0874c8a027ca49f6f47

SHA256
9081d23537eb2c591c8e874b6625e34edc9d1c528424591fdda1b8d048fd6605

SHA512
43639ca1b74a8b47ffdf51bce7e8ba9a31a5ea5dc170df38181642fae6dbf30b1a815102e71168aa04ae563d0378da946fbf46f141c6dec11b7eeb3e076dc6e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f3e22dea392b48a597d0ac20c4feb435

SHA1
99cfea7164b41338780070f5ec4cdeaef16d374c

SHA256
a31033472212d003196966d76060adb9931a4ec03ed993674c485fad08e9d836

SHA512
5c1cf00da613bd5a5bd0f67d664bd33ea7541bc4e6d8223fbb86441c31cf41a53c3d8bd5f97805bf7074f2da55db664d72378794bd0f5accd3f363b30abf1fca

Download Submit