hxxps://drive[.]google[.]com/drive/folders/1wM4E7wojzTbZI_zXZfIdfUwEI1ILMDLf?usp=sharing

Resubmissions

18-07-2024 19:28

240718-x6sstswcqg 6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2024 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1wM4E7wojzTbZI_zXZfIdfUwEI1ILMDLf?usp=sharing

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
7	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
672	msedge.exe
672	msedge.exe
2552	msedge.exe
2552	msedge.exe
1828	identity_helper.exe
1828	identity_helper.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2184	2552	msedge.exe	84
PID 2552 wrote to memory of 2184	2552	msedge.exe	84
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 3356	2552	msedge.exe	85
PID 2552 wrote to memory of 672	2552	msedge.exe	86
PID 2552 wrote to memory of 672	2552	msedge.exe	86
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87
PID 2552 wrote to memory of 4844	2552	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1wM4E7wojzTbZI_zXZfIdfUwEI1ILMDLf?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4a7346f8,0x7fff4a734708,0x7fff4a734718
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,4817645962544130390,9730883889632096066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1340 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
28KB

MD5
bfb4ad144233248db8f0b493c9f53943

SHA1
75f204ac49008ca945d35db03568db5ffa2ee27d

SHA256
57819395af403b8697d446c0ef64388fd0f4b33af5647bf8a79d0616cd903393

SHA512
0f5f4ffdc046a81da203998f22ce0f156036b3c14646faa1b1c30d6bd0cf5138b70b3d5ac60b2b6eed36d2beadc108b78119f757bea84705ac71a8f1b3d4dd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d99da702bb35af8a5e44e51a643335f4

SHA1
43e70f014970e14f02a0bb3aaaa96a3c3932a7f0

SHA256
f2710e87a6ddf7bfdf411c4f0a4be673b281eb065effbc3739bbedaae1bb760e

SHA512
76cf5d923083abc563cce901254b72060ba3cfa5d2bedc6215f5c4bc61e1f562eeaeeead4556b3c76e41d81f352c745d066e7bcd265c247423cb2a763d254447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
0b8d7d508cab94c7e3f51cee49a44a1b

SHA1
b7ed9ceb2d471f7427e887116ad7aba5ca1738dd

SHA256
aa5b8d222584cc4e4011bb8ae4d7611d4db6e08039d8d33e0218fe0a25d62fb3

SHA512
d6543a5c622f74d0385f80ebfcd010bf647f080188cd921d5314f06872a482a73ab19845a15712f7701baa62af2a0d06c0a1294fe4c8cc4e2f239c5f26c9f31d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2406693348083f7bb22a4df91122208d

SHA1
96ab80c6cad0189f63141f1c4d4f451c49f0ce53

SHA256
cce6dd37042b278cc16788ed22729268c472131f1f66fa1fe1adcd97f60ba6cf

SHA512
06339cb6efc5ba69555c87a18ff34c5892c9ad9aeed041f388184c2751f204e1d2a757a790be690154c3adf72d185b2470f45230a1700a53eb98b864a7568144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
80f1d6c4dc937bcec4f0db88841ff642

SHA1
ead4926976e0b600c837b6257f96a920dac8a767

SHA256
e78a99b6a492569e08723175d31f0223020abd81d155e95c1868dbc99034312d

SHA512
266cbdee5478d38167f30608c1e633d8be4fc33ea9549f06d2283db518dd4c0a8b50c32aa605f8f2ad801c1ad57107f1291f946ea94868f4305863de37049156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
098368f0eae75ec0ea72168dd5e0bcc9

SHA1
2338ac9b8190fd2b3c845771614efd5199330549

SHA256
b918fdf2782d805d4ba5abf7d0f994295cee493521474eb5ead0e5f83eb4cf1d

SHA512
c2b54b608498b7d59f4d9c1c25db26e1fa79ffd198d58caee8b11cf04c6022eefd991b41badcdef1152cf58ed7ff7e8e9ef0734d4949e1240a92aeacd1ef197a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d5240bd1ed9004eabb5417da3b02148

SHA1
7f9b7e58d3c61332dff09fa4c9f9bf4048b44c29

SHA256
7254449519e2b0e6be2cc8d8cfe91f289f05994ece5932e9850bfe6a06d48857

SHA512
f09232816065ed3c02cbb85fb0f93f9310d0a3f591927ef60b6d7293ba72ce3bd1b786311bd674db3951bb6f94e82d1150a9d2782e88bb8c35fd6fe3b84b4aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4acb3694cbf762cd38efb2a742117da8

SHA1
ef204957a247443c4a068a0ee6d0e74d282d0c87

SHA256
337ff3928d9a925d2ff9f9fab2e42d5a643a9f03fc2b75ecc789c1fe6ff56553

SHA512
334e609ff525ef649c28e9145355700b0d31be766f2985171be6a6198161381aa519be54637295a95aeb99809942bb35251e9f946f044658b9302f24713d9b6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
25a6c60229b5ed75911fb486c5eaf30d

SHA1
6b066a740ebc6512368cc67db0513150799055a4

SHA256
4ad110a38645b57ed17ea943791f23b6e507f2bbcc1c76994901eb8bcb053ed5

SHA512
013478b98adf07b0bfa30adba7b780362e48220a4537d554a547306d375a56954aa29d39da7db794a9df1e89adc13da9abebb78338af65456f228eff51786f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d4e7f1f968edbf5d584c5c42b09f95b2

SHA1
c7f269d0588305123961879dfdb48e4e06440d39

SHA256
f45092891f28f72c38c1e86a7c90be3c733e23c50a07d4cbe43282a00fed811b

SHA512
73161e3af86911b08658f679ccc0497ece19fd13d4ba8e64c63c9b3abe7fb52453152314e10b48192fd2a66cd56f67e2d9994889830e0338235531b306118a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f1c2.TMP

Filesize
1KB

MD5
3709fe5fc8e93f11c1ee404101afd6dc

SHA1
eecfd73cf93ab30e26c5e937aa3c611efc6e6374

SHA256
bd73c0f8d0f44f1eb89d1df10decc2dee16aa2f72338ed417970af6d4d82448f

SHA512
3daf54d86d88303e7bd34b8046421ddc36178363409f71af4712a0e917035bd59a304747db474abb92b0dd705a36357edab2fca879ba0923defd6ffa0c6340d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8284cc4b1549faa37e7fb453565b7e11

SHA1
e95d79805a34309e524f44af28c292806a1e9958

SHA256
24a0cd94e6cc684a4e72116409eeb117637b5ee1a10969f933a1d51c43d4d363

SHA512
ad60c3a9331b42493a5b7e028b7298ac433c63d20fccb23734e6ec6b252a2e074184e538da21a70b86773e1b75c1317270fd2d7548980f0331ddc7d6dcd3a8ff

Download Submit