hxxps://drive[.]google[.]com/file/d/11GPQsSWSDjflQUDDtAOR5W2cr44xcbR7/view?usp=sharing

Resubmissions

25/07/2024, 17:09

240725-vpcdeawfqb 6

25/07/2024, 17:06

240725-vmgv4sshmn 6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/11GPQsSWSDjflQUDDtAOR5W2cr44xcbR7/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
17	drive.google.com
18	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
4536	msedge.exe
4536	msedge.exe
1208	identity_helper.exe
1208	identity_helper.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 2644	4536	msedge.exe	84
PID 4536 wrote to memory of 2644	4536	msedge.exe	84
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 3584	4536	msedge.exe	85
PID 4536 wrote to memory of 384	4536	msedge.exe	86
PID 4536 wrote to memory of 384	4536	msedge.exe	86
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87
PID 4536 wrote to memory of 4324	4536	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/11GPQsSWSDjflQUDDtAOR5W2cr44xcbR7/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d53d46f8,0x7ff9d53d4708,0x7ff9d53d4718
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17002697477799574687,5255097533651439711,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
298fd33bf4ace359571ff5ae0cea1396

SHA1
d0f712a71c3016c322118e9d1223300c86306434

SHA256
95c568fa92785df23c643da18e3d786f5f29bd42959cc988a0d6cfce4f4151f7

SHA512
cf07ee0d49c4111b93b6967c6423f70202a0e1985545b4c4fe6c410444e9fb058bf64eec03bb91356487cc49b67a95e1487e50c9d34aef826cdd555ef1238526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b661801a843751f414b932372be4ea15

SHA1
7c6bd3ff4a6f104f3434e7d4f17864dbaa9759a4

SHA256
585b0b190e080b9ef8edfba6e40d1bf935a9675a74278e1254773ce9306ca5d7

SHA512
0e7d19690ca4d62f84c23d21bbc88fe54473a58027f6a2918afc14a95f94afa13483d8885e8309d630db09e38f66f79756288fc4e3868b82c32536263904abb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
54c2e0a30905963d22f42e2ca1c3f9ce

SHA1
3ee3b46aec72317f239de1ae0ce70bad474668a3

SHA256
62d7e1f4fe2c86c5c45d39523a5f2c93ffca447f571592f98993b109a29d63eb

SHA512
45dc89f89ce353ce86f002ae0c66ddfa74c629de8d0047c565b03e5cb32b03c59653e92ba1a6da6142dba8b3809d51808b663974abcf5e36451c54e61761d92b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
360535b53468baf34c90fd483abcfc8c

SHA1
86108a45e2d4ae8c85b8c109c66b1bb9a25e34d7

SHA256
c0bddb35cd1beddcd1ea1d1afa82b70bdf0515a3c91765f656fd96be6534fa87

SHA512
4dbc6e9086de06cff486fa3f88d4f48132777d76796713cb16a39b47f247d1832d130bc0260dc066f75a1bf1322c911a9c4de78af3bff79d635d1f66ee44f870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
387f54955e08c0c208d9ad1f088804ae

SHA1
abe10392c8d973cd6d44508c91186ac6d9442276

SHA256
8184c7658aaffdf8cade80cd5a219d72b42109885a83631eeace7fd107b170f8

SHA512
d2f6722965e0dc842fc122a973a840d0679f671142e2daff811faccfb14db3b9ca49e763b88e3a7a76bd103f0716fb7ee9cd1deebcd1fdfd3951461df97e0d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0b88e3da061090e2af041de2082d079c

SHA1
fdbd7918ac661cdaf1e273039a242efa6fc2387d

SHA256
436bf58f2f1c3e41735e545df85c76b47464a30ea29614dd30ba158af6f29f9f

SHA512
851ea690995670c7a4de637a391a399f22c7802062c0713fc4e3298e4a99e31a5add7f5102087a28a9d5626f196acfcd83c312c3f9b2648d1f19bb35cc2d4383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a508776c31b623b10cd96c0a740ed157

SHA1
b30dc1f788ccfa583a103ce65bf8c476d197fe51

SHA256
1809a31463b1f46ac8485da63e583e62ab58d67dadeb3c5d15750c60e4b4e784

SHA512
63fac5441e01475d4f1eccd5ff8a4ba25e81e907940c840dbe9d3e10c29dcf51660a71dccbc67a296499fafad32ca121c4bb1376137f5318628f133aa4098acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
073fcb55a244b22e5cbedc1406d60332

SHA1
36ffae669b935fcfdfaf760839fef80324e1cb2a

SHA256
5418919e14a0c8a729a1af0aa4532f408436faa76dadd50f06a4b719baf8f18d

SHA512
9e219ffd1668dfefbd30a63d8c8d08d8aa4eb527f31b30fb1d46ecb08bf18ed49a9bf7afb97ae6c0f789b5b8cc01777154abbd6ba721bf436d8d1524c7c886c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ecb97bfe4b97c51790bc07d9174dd158

SHA1
bcfac49bf56bd72ca77ad99be7e0a01cfc48f0d7

SHA256
d349f80f039bb50387d683093be6cf7eabd60b58a3755f1456424cf0d15cbdb5

SHA512
5ee1b0bd9bd1a2c903b9ef84591e8a6eef5ef5067dbb01fcb8d87fa59c44278e63073ce5c3e95113090a7e28b6a0ed200de67ea02ce2765ff5eca5874b9b043d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2eaf78abba98303dd0843a4a76399108

SHA1
429ce337c43134e85224131c33e2ef506ac84f5d

SHA256
4a26f6465faf61fc859fb29264f41999909b4bbd01ebf4cd4e0e95eec58f50ee

SHA512
2767757955828644789c84cfa98b2396ce59a2b17468e157ddd88ba7d4745c166c039022d17861975875a99425824544887b0d95b1bfa4c6515bce6ba59d8423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
18871bfff1fcd13b501b7337f7eb9de2

SHA1
69a0ddf280d9c3fd9f80c1cc45f35263ecdb3506

SHA256
f1a2dc86d2f38c214769dac852006954e189637a19bdc0b8fb22c6a66ac6e0ad

SHA512
94f1eff314cc97cc7f7fa1cdba3bf2730eb7c6686519ce6de83c1dc83c822d05b474228222edb5ee9e902f885e155cd20c75ea313971254c29da252a1e4d0035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f461b0117769c3f6afd5b9e70f804209

SHA1
8b2cdbbf453920331040d220d048c525d028cd49

SHA256
128ee48942aa9ae9a9190a86978f88cc344689f4c89c2668919716bdd7539482

SHA512
d909db5a6585acb1b48646eeba8f54e78290c618029bae19c4e9e677119ac9403ce1c17b4c2360949d39407e587542b9b7403d39a864bf1ef811d9f3414ef47b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4c008ad5d5e5ade1cdac73ca056bb52d

SHA1
3039f87d9d0447fb781c73f71a6fb399e7319160

SHA256
23719fb0b811883fd22e1570fc8aa231f0c214944a9345741aad70c9531ddae7

SHA512
717d68ed96a90c01c727b6a3c3a130fd0f08be8c54ecf2e889bbfaf5bc9fab82030e80e2ce70449d3dbc078bbd8580a2ce27ffcf83b98d275d47ad422a011f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ddfc.TMP

Filesize
1KB

MD5
97aae1b4c3fa209e429fbbafe4037e65

SHA1
fbdf49387fe78caf7a98460a054892bd406ee0e2

SHA256
49629f9e28ebea47f949f48da9fffa5a734d88adddf9dec002e96c8af9ce5e04

SHA512
6e0515a5108b1c24c85d55bbc3837f919b2e12831ae3c6d7db7b45312218038ec99023bd2196507544a7893a4c46a49bc25d994ea816ee65ce588efcb16a1c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fab10bb6a6e5506467c5fdb5e7a67102

SHA1
0fc740894e36ccaed9e240a12621b9ee78aee79b

SHA256
68ca259815cbb27e52bc82a2c273220c4a2f8df44f30de06067c0033829f37fe

SHA512
82a62f7269c0383feca70f670bbb648bf5ab5fbe1cc7d5381e1473aa3339b6a1046a57f61e0ea88dc07c57a3193d7c3336f113892e4607aeb58fd244d3647e0f

Download Submit