hxxps://gofile[.]io/d/OgdM4f

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
31-01-2025 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/OgdM4f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
3312	msedge.exe
3312	msedge.exe
3784	identity_helper.exe
3784	identity_helper.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe
440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4236	3312	msedge.exe	83
PID 3312 wrote to memory of 4236	3312	msedge.exe	83
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2084	3312	msedge.exe	84
PID 3312 wrote to memory of 2612	3312	msedge.exe	85
PID 3312 wrote to memory of 2612	3312	msedge.exe	85
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86
PID 3312 wrote to memory of 4196	3312	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/OgdM4f
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad13046f8,0x7ffad1304708,0x7ffad1304718
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14431955151777733970,4818031712858276947,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62e6ffe7501e581c80b178323e921b81

SHA1
d0881a3d0aee1c256291d34a90e3092fffa60ce2

SHA256
a4f50a6b36e27013a694382c996a1d3059d38310a138f21aa25cc682be5cb0e5

SHA512
0c4e34fc9a7c5308b1cd05ea71d78c75a9fb85267d7f3e5616dbc1390794941eb549bcc70f7430046ca79cc0055edf0bd51b8eb43f84ee42163dd34d612ba137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
65a84cd7925378cc74972cc4e677ecef

SHA1
30b4da4c5dbd0cc77d756d270ad260ef74987ccf

SHA256
7be0a4cebd74cb4d879e3f9950f5ac5a05acc3bdc415bbf9d3dd691cccee2cb5

SHA512
ef142224cc0b94a1c5585836988a0d544e7e8b5e8573a1893c9fac528a1ccbbab6c9c7acaad7cfec1a415544bbdcdfd1d0c5e0a0819cb94107fd81989df18704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
5413cdfb4e8eb8a30650735e41028262

SHA1
ea3953d0a009bae7393f79f139f35f9dc72c8e91

SHA256
a8e0dca6c3ae78b8f882454661980b289016bac9a7888be0f04f0287afb8ae79

SHA512
98967f2b18bca2b050d4101734a03051c1d2c9705d001de2978ca0e435cb28004ee9b50ea460c68a07b20e8dd3885f710fb69c9e98d61b73a8481de98ab5e9b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
317B

MD5
a22ac98703578dab4e089f7b2658181d

SHA1
b9d19070e3240618f659fde83c5b05c97ac891dd

SHA256
9d8b38da47c2ef4da94c7bb3ba34317f2f5e57f73db0c140396d2b899c7b7e45

SHA512
0b460999da4153be276491d1fdb4291be6e88c7c86ad074d5219dc7dfa9cbdf0f84299c2e7069c28a451a9a624682f84450acc2c69e47a78f04c3b4747863d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
436df10aac8f3cc9980a89edd236ba35

SHA1
35f7c7117e93c63316ad985464fb47da9b297007

SHA256
819a142655cdc37a5b8b96c6111cc7ea15925628f7f3f99ff44fcfc4c128c176

SHA512
c3881247fd5f7acd82a5b21de0dea140977aa7360c76dcd8f01a079f64210698b148d5f4445bc7285a4f2695ec1c4fe4506912893a08fc8809295be7893ce465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ade04d0d73293ab2d66be8218aefdf9

SHA1
2f50d07bebb4ed451771c3716bc288aa0e5a78cb

SHA256
364ca479dbb2557617797b66573ae4cbc1adf83a8ab2aa481bb7e0429b596b0d

SHA512
05fb9e7dce42c3822ed030c818cabcfa059611926482e8e032b67376d922187831be6595c7879c2f4d546443030ff3bccdfa303ecbd26828e5a1b5a1d55a557e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25e8fd6e7e66d4e84b6fdfd1b05c595c

SHA1
9ef018d3271669740f7513aa9a72759518e8dbbd

SHA256
bd90387a1473ab61b05af4c8cca819107b4879aa62dc950068a2395e25f4a3cf

SHA512
6fb7e8e12d0f83860be815dae8affbf0e2b9184766db83339ac008ec684ae51bee1445ac05916cffc308af255f14c27a812b16d2b484caebe7c2063725bafa9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
2c4288df5fb94a03f64a8d301ee0fa09

SHA1
cd13b46820f646bfda2a40955057504da3453da4

SHA256
0d6164ef788b079353888ae2a5e784271e6c62057b347de0563f9a64e8018a81

SHA512
188948d379353c9a39e55d35afa713d9b0c7c1982c54c3ede2adac458f185223bf8a6e55314bd17875d4e87c8e9e08ad3fc59ab37e564efba60e2e650ec1acd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586627.TMP

Filesize
203B

MD5
c568bc3f6730a24ca18a8d97c93c6252

SHA1
a4ec2a5f806dc13ce96e7f84a336f90b77461801

SHA256
fa4e440a968b9b8c95b758eeb3dcb2c9e0b24a19578e8fff91de0d9afa053f45

SHA512
be5f9ed393e1ff6910c976c3bcc31f85a76f0a6e3a0743584d70821aee4818ffce8f296ff0ebf01562a10375e06a0622ef9c3420f85d4d06dd9c001fc4f2da86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
891f84ea329319d54b67217612706209

SHA1
12d13b36bff0ceda3916b77be7f9596eadf12a5a

SHA256
64b167893030552337f916da4e655737b19aebd55f5a2d1caab6f1193462552a

SHA512
a0417039a36d30ffe04d77fad0fb6b74144eb3f8c756c92555b88268e14f3dc422a21e2bc5e0e85b06f77a170ec047f8663f66c0c6f5a13209d1ad9d5790e716

Download Submit