hxxps://drive[.]google[.]com/file/d/1RDeGwJy12IQRaim9yNVXNPcszpQPZTYG/view?usp=sharing

Analysis

max time kernel
164s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2025 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1RDeGwJy12IQRaim9yNVXNPcszpQPZTYG/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	drive.google.com
14	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
5020	msedge.exe
5020	msedge.exe
2520	identity_helper.exe
2520	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4080	5020	msedge.exe	85
PID 5020 wrote to memory of 4080	5020	msedge.exe	85
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2096	5020	msedge.exe	86
PID 5020 wrote to memory of 2468	5020	msedge.exe	87
PID 5020 wrote to memory of 2468	5020	msedge.exe	87
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88
PID 5020 wrote to memory of 3960	5020	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1RDeGwJy12IQRaim9yNVXNPcszpQPZTYG/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1a8f46f8,0x7ffe1a8f4708,0x7ffe1a8f4718
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5724 /prefetch:2
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,502119476327632197,16451825069754609175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1184 /prefetch:1
  2⤵
  PID:2808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
2a09a2a3a8b7d90f27b30c4beeece539

SHA1
d68205142414f6a7b0164f6609c7f1e25d1d00ee

SHA256
dd677b5840e94d010362e155013a733934932673c5d4cb80d46b937ed9d5c84d

SHA512
dc4ae1f97ac31e6e70117d46bec944d4e78e4cfb9a42be6ac0e372ce7a15b9f6e1bc7608765f5b49132cdedd5946c55d40fe3b621b6157cf726434528e185c4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3b7d2f334a50d410df38eefe6241914d

SHA1
520e161af2edd622f193804bab2d112cad81a679

SHA256
4ac6787072f70647fe88a493ed097b061b7f032c22a544447656a9414b34c9c4

SHA512
02fb8acc159c262e495ca8afe1469a47cdef84caa0b43f515898dd9bf653eef3b8fe6f0d3c51728069ad55bded731203911ca93bab5868d681c467c2021864a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
367e2b63167122814b6879381f7a0364

SHA1
33639be7fc9828002eaae49440d17f87587b37ea

SHA256
0229aa2cfa4997d7820021a98cd106434559896457a36a0413d04aef9e4bbe31

SHA512
551dcaaf841b89cde78536d9c3d41315674b3641ec8bcc9760fc91a0d0d35db33b4af1d7273ad0e1f01dbdacf7c1779678cd6c53490e2a315a8ece42d70ba375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed81a708c253eeccb08fa460adf5adb5

SHA1
bf1397caea7a68552b9f5ada088b0257ae75c26b

SHA256
e06322022801b392cf34da8e5d296bc8d938cb57233dfbc49035521a4fd70661

SHA512
b74a63726b146176c5e8b0e57520de5faab461ed765689c7c03d609ed3f77c82bd15bfc2d56d9dd4f114dd68eb0f36bcf738a9f0f4c5ae3c1465a9fff6643a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1d143b9035fb41c0da6fabc59af6294

SHA1
1606a3229a8d65997459e042eb49026c4708d358

SHA256
2b047092ccfd3983f7b8518dfc6af77b4ccf70f3e5b2c293619c8ba439fed668

SHA512
33ba84635d51ed960284baa34505af9fd551b8b511e3c9ad432a8c63014f86a53f223028f81090b995e72b5a5a923de330c469536c0b52686fd2535f24a6ff24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cbb89e561bfaaf90d82225336f691e70

SHA1
d95dcec6846905964fd6e8e3893c250105076ea2

SHA256
2c677ffc553924159fc4eb8ed955bbd2ec58e4bdf7c0282878a27905bbbb822b

SHA512
bf1c985cc4ea1d84959605a0dceb52a6ea9f6e2c536605f77b3441f3608ad2fbf758fe0285fd695cf132f8ee56021b1f16c5fca475488f80cf578fd764e638fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
41b29f5675d4d22d03fd94c081644703

SHA1
70a2731011f4bdb85cc85bc0bd2e1461df9e285b

SHA256
54ebb5d2c6cbfee3d567c8c4f281c41d9a92579ba65dbb6a979754a5432efe31

SHA512
78f53b7b2e56c0b637095303cc192f164d5c994c9c83ab4dee4bf958819f7a782561bbd1f90f28ee7f9dfc8128094998d81a6105e2bf0ccc32b7a1d3ba902b48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8185a71778cf0492fad71da42cfedfd7

SHA1
ae02e02682e5c1036a1333ee93157284602dce67

SHA256
fd910083bf8027137226d35f0410b63e3c9b85fe455f9faff2187a160a1b322d

SHA512
a24d641e0008c928c8b76dfbc87de2c639be62348cd121a306289862e2ebfdbfe5387ed2fddf3c94cb4cdadb19c901ee84a51d48471426c5fd80c93c9910ebc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58eb74.TMP

Filesize
874B

MD5
75d68a586c79df55db7d2410e9ad667e

SHA1
018c82a7238e0a3954c35f0742a370143621e81f

SHA256
09ecf4445526edba22a9ce5d3508a429ba8a4a5298fcfa1eccc824fb1c1f41d8

SHA512
241796871e7a2e98f8f0248c5f211efe5b98e7bd6f96bbbc2a336746d895045520ad76f6009260f831f77c981f51f86ed70b29908d879360c084b0a431c99bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0fc2ed26d2c3432e7669fe34c3b13d9d

SHA1
ed50e091d80651cb56f93dff87b3fa82d4cf41f6

SHA256
b5119a374193994c517bde87face2b46afbad732315e17e32bea54bf38267d9c

SHA512
4dc189dbf99d2fa5e9799cffa4bcb9c6a4fc73d18a6afa23e9b56d283a85034ea387c3416fc47b328820dbf437f2edb13350a1c825676ae3e456d210cc5658c5

Download Submit