hxxps://drive[.]google[.]com/file/d/11GPQsSWSDjflQUDDtAOR5W2cr44xcbR7/view?usp=sharing

Resubmissions

25-07-2024 17:09

240725-vpcdeawfqb 6

25-07-2024 17:06

240725-vmgv4sshmn 6

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/11GPQsSWSDjflQUDDtAOR5W2cr44xcbR7/view?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
4	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
2852	msedge.exe
2852	msedge.exe
4520	identity_helper.exe
4520	identity_helper.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 4284	2852	msedge.exe	84
PID 2852 wrote to memory of 4284	2852	msedge.exe	84
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 4752	2852	msedge.exe	85
PID 2852 wrote to memory of 1456	2852	msedge.exe	86
PID 2852 wrote to memory of 1456	2852	msedge.exe	86
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87
PID 2852 wrote to memory of 4908	2852	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/11GPQsSWSDjflQUDDtAOR5W2cr44xcbR7/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8dd046f8,0x7ffc8dd04708,0x7ffc8dd04718
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15885510318942470619,741932680366899839,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d0bc11a-7bff-4923-a96a-2b2b008b55d9.tmp

Filesize
11KB

MD5
7f510ef6e2f938bf65c458ef76c0a380

SHA1
f6c0417bb5395d6c1d3554d63f22c179e752776e

SHA256
250a939a7abca8b66f253dc7bc03772a6dab85acee3c5430550a78448c812be3

SHA512
b2dcf67c91d3d1471bf08887f354dea3fee4b802c504a98733ef97cbeaa69bc4aae396ad6c8099d62b617425a64b88118177801addcd916cd6b3db28f04877f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\385476b5-99ed-4f49-a16d-212171dd2ea4.tmp

Filesize
1KB

MD5
93027d81593640623fe813290413a56b

SHA1
1cf18c9c542e7712f1fa9323da9c724888367a04

SHA256
9be5580ee151cb120eff3fa4b757613e8aea6108ca01b76ed32d8ce96c849976

SHA512
9e9fa90ffb028b73b386c3af76573d71178854e7e29f46b5c6a7bacd3566456e39adac6851aa34b54a8bf8f6b70dc28d33b766ed8f2c1eb1ed381cb12c5752e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
a5b94edaf41fc27185c905c8844f0d33

SHA1
8f26b7f5b60633a247136d861a5b2caf801d6ac3

SHA256
d16941f19a2b6905d7f4e8a08e0a4140d33178132b3dae434bf1206b786e136b

SHA512
267da95c0b407c5b037beb3248d787d72a044e8b58edac950004025435ec7de450c9f92210101b7716ec3db86334d289cdf76f9196465c306a77bcfc056b3e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a938772c6f5198870d634f7d253d4d97

SHA1
efccd85d49ad755e5010bf6e121af1009a804e63

SHA256
653a096a8924b07ad68072fa8d7ca7387a6a7534aebf87549ad393d04cf9be5b

SHA512
9b02cce38de9ff4e1167268a885329d6fd9002135844adcdb79fc1b5f4141be4ab1aec67a9ecca1117fc4b1124a5af1d789e2315d0c15978b907796eb02cf264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d948f863366af0d0a929ae95ae1719b3

SHA1
cb5913497787a29e4c5d0366a70cd6512b0cf2d6

SHA256
a3a5717dfdc8307ed2ef92824f81a1ba87223029f68b6e1b62a2390044e27608

SHA512
3b7326f465f6fcb07f7b7b74c0600f4271a9eb29463863159668bf081c0a7ce24eebb8871400f1dffd9e42eda687ad513de3a4f8b1801d54bd2cd1c73bf1d263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6c588fd6c302af087a080c647581669

SHA1
3c9a2459d1f7786e04fa3c7384c234dc79116214

SHA256
1d52f45f9da71d4d5ead28c196b4f403ba5a7160666ab06114aab4346192cd57

SHA512
e69272e507c09b24d71dd6ed66ff4df80446343ea3a4e03e54043a20ff0dc617218a7e0c2d4c2c2a829882019f8828baa9152aaf3e8eb6c791b2056e09faed10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e38947bd5f57e16d1cc5513fd6dad57

SHA1
ee1bf636729c68d880813ef2c09560f8ce4bf7c9

SHA256
9e490d17c8d397dc38913c1302af80917caeea0a64e1116a76910283db63ee09

SHA512
1e2a07d0bc905bbf1601c0612160ef9726ae40929cf9a5228493af3ad7a67aa149aac1b3416da57327231806689ab5eb4d1b43e435930c209d8a577ea9bfdf01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a8bfe32bf7048c2b1a7f17105336e7b

SHA1
7988eab16ec01e6ea88d7e6f972700bac3fb9a2c

SHA256
73d0309582353f9be2358bde9c364d3ccc14c411b7ee5633125db65bde148fc1

SHA512
60da5b6616b844a8f247d20921310abf0688c3c21849180e8ccb54eaa478bb4c194c18ba7cd688f60f866b3fa45e2314cc9fd85515cb705452e5a10f394b107b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5dddad441a50f18c29bd646b60e8332b

SHA1
0adb03713705cd207bd03f76b4f127cd71256ea6

SHA256
7d5534f8a628c5912982c16a1acc2df6a67563698d7388eb33a8c4ef9b989377

SHA512
5453bb7c8837595c0852ce3d4d6df7fef0bfa4721619bf8946944fce16c6e0fa4b75669af46a5db93bdc13486af77b492870f6d344f4391253d99ffa67c56d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cb1ee5b741db6d939471771194218aa4

SHA1
fa73dfe8f03b8861f4be39150a358860d060f25c

SHA256
278b6a6788acea1a11e1180ad3f0aa3e0cffbc0afec22488694f635e6237ae61

SHA512
b31ebed8c10258dc1ee8287c7c9bc8bc64b9f3607ce649b0d5bb40032ea0dc4db0a162fe64ea0b56c42317ad2dd22c11d0b45e5044cddd438a73d787c012cc2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bf6c0bdc5a63e51b4d356bdabe796764

SHA1
df3319bd5378930a4801575338cd411c48fb4e3b

SHA256
e4e52953f847be38edb93f9802c0e6ad0f5cd87f699250b70c5f1e379f2ef63f

SHA512
359d51d723e131d981ea48df78194b9c11b16b7f6d2fdb9917636275eb74cdc8b7538c94bb5c72cacb6530c03829ed7a83c7b3edbdc3adcf9ec1125edde7cfca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f8f6.TMP

Filesize
1KB

MD5
bb0b52ea6b91b6a4ef9f492296e1b551

SHA1
aa04ecf69e2a271e9fb90e524d779d308b3ca2db

SHA256
1b089b328769bb3bdaed1c3f6c35574dd92aee61e3d0a8ba864ee1529545fdea

SHA512
7151501e0293fe4d8d0e98ce82e6297fb887323f3f3306f700b085419df1f995f00982183a38ab8b849ed17dbd1d8b4eaeb542919eb550fc5ecbf796e3b29e20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit