hxxp://drive[.]google[.]com/uc?export=download&id=1ooHzNQswzAa8s0MNpz-QbIwifdTqPu5e

Analysis

max time kernel
112s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2025 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://drive.google.com/uc?export=download&id=1ooHzNQswzAa8s0MNpz-QbIwifdTqPu5e

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	drive.google.com
17	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
75	api.ipify.org
74	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
4500	msedge.exe
4500	msedge.exe
540	msedge.exe
540	msedge.exe
2976	identity_helper.exe
2976	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 2352	4500	msedge.exe	84
PID 4500 wrote to memory of 2352	4500	msedge.exe	84
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 2736	4500	msedge.exe	85
PID 4500 wrote to memory of 3788	4500	msedge.exe	86
PID 4500 wrote to memory of 3788	4500	msedge.exe	86
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87
PID 4500 wrote to memory of 372	4500	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://drive.google.com/uc?export=download&id=1ooHzNQswzAa8s0MNpz-QbIwifdTqPu5e
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc3a546f8,0x7fffc3a54708,0x7fffc3a54718
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5981421096326256203,18139924888454844676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3400

C:\Windows\system32\charmap.exe
"C:\Windows\system32\charmap.exe"
1⤵
PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0504c0d0b9c007a767de8a404f2ec484

SHA1
73b1066ce283079341bc94a3e5c65535f0523145

SHA256
3469f4679beea250ce59f3fa4721e48f81587735f44e0fa2b70638b78dbf8a2d

SHA512
c6c0c6edbaab3b92832c4140916e99ca6725b79e5d3a43ad59ebd94a567458ef79923e2236b43344ecb6fd75442d0c7779b024edbd1bf9035a2a86ba7e5ce606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
50236cd957789ed0d1b6564c7f0ecfae

SHA1
4c9e4dac57ab9ffb5bc55154d6ff89f1e6c1d5f4

SHA256
5820467c07d06249a1462b7c9deeb0801a8a6475ea19637397b9bbbc95f90fcd

SHA512
1cbf4be5224fecf811bf81361d6d282810de016194b17e2002d510287d384048272215b813838912eebcdddb1f657ade0aa3c122871c9d636b6a8fa8e74535d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
fdcc797196806c7f19bed6fdad5df37d

SHA1
a2542bcee144df3c30fc53f819d23a415634a4af

SHA256
e62ffc171546d113b4c9db2ef40e8c0decdbe57d31c35bda4c903024bb45c0da

SHA512
ca10318ce6cf1b9433300c50cf64625841eab42dc6445be10e8d2c7d37cc92d748c6aceadf4dc54d5f1ec6f37b3b2a6d9c068a06b5491ab6687c86c07b222eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bac32d4285b7d7f8affeb44b99b1f80a

SHA1
cd29f0906910ae2b18a88bf737d1fabd73a3bbe0

SHA256
60150a1694c86255d644a3daa3bfb2665e9fa9f37666b5a22b1dc754385ec513

SHA512
b237ae9f94cf38d0521f7b4097faef6be62344b763266300df4869d43829d436fa764e999eafaf435fbb571f628644d113e9239a944e19f4c060d9f9be6b1d3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48fe737fe2ecdf404bb72407bde1a0d0

SHA1
811e3de7a37bcdb7bf86c60b67e60ac76a08e581

SHA256
beb97bb7966ded98b9de2124da6684e46c47604e65b98da74df5dadc69858152

SHA512
21da1b822c40dfcb9875a553ccf996315b09b94dc2cc72c2428d0c44f2bfb7fa09a57e7b0a5e1aa9a3a70e40abb69e7529e3751b1e481ba1557d1da3ad8c3962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3f015f4ff0b4ff9de4a0c760590c58d

SHA1
82357916346d9304f359552517166c7bb6abec87

SHA256
5c3b8bbddc960993f2b3d4583a1128174ea02c2829741b0d3effa93b3bc26c9c

SHA512
eb771cd75ad2e8f6d59600a4e19f1df88436ee2171315b49f69c03742a37f17d14f8670e3d77b27fc01b1c0dc1e0f3b705ba51515f71df4269850c4fcce7023b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9d6db33f86ebf6b17a34548d020c46f8

SHA1
c22f7db67158bf5be5a27e2086ae5da0c9dc446d

SHA256
66a6ac26761cbcd89bfc48ce647b3b6106861a7510feaf0888acc95e14eb2c63

SHA512
6a9cd8e84094b81df94ebee798763901f0c92e9f40ee1f142f363ed7d8fc8fa0c35ce1ebd9032e485e85c63501a18fe36fb3cbe8ab9ca7e9b278fa742a6412c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b89763f8b7014513e58384c1a1260ff0

SHA1
e2b480f73bae48af52f112a26e594203d875477c

SHA256
3cb1b2a8c3ce58b11da90c8beb0763017e66ef5a92035fefba67ac81aeb8da25

SHA512
fc3843bf1f24d3c77ec15a2f2f1c26bdbd629ad2c785abdbde29de08f931db45c95af4713a788605611ff2e181fa4c85c1f965b947e8513d1fbc0337e04e5d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
4a9ac8a6555a1b9193a7ffdde86377d9

SHA1
86787d4afd1e23fcd995c1f4efb2aea9909cff71

SHA256
77f623b8896c5567f1a054f146ecb1a4e0b7dc5bc54befaf5039b1e54707ecd3

SHA512
687f441571f7bafe7fe78e778c062747505160477b5074165c031770f6d2cedc12c621145146672e77ac86693c0098e07185781465412752a1be47589582f5a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5897a7.TMP

Filesize
371B

MD5
abc6986a8007401454bf874c3d8aede4

SHA1
ec64ff1a33cc8a9a869fe997a231bd69fd5ac1ee

SHA256
8123bf5d090de79083a388200c47cf0bc8c828a4987ab7b93b1554d1599abe2d

SHA512
33906776ff305f906ccebffc97ba3dbbf8372ca8f7addd045c1f8ed09f4212fb4a068b1c5ae073e9bd01477824d4b8b084c45482f6e4f005243b9b062f8b3cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d6ad79559953e4eff12b69aa285e8a0

SHA1
900fa51f1b97bda7924652c20ad8d945b28a3d2e

SHA256
fd34fc4db1c2a12660f5d61b5ebaecef10a4bdd0490aa32ac76d41ec00f06374

SHA512
81b60899d9968bd2ea6e7e09cc09ab4fc1d33277943b93c86986129fba324dd5d901b4083728839f9b9ad94f7063aabd0bfa662ec57677a2009de609a745e562

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit