hxxps://script[.]google[.]com/macros/s/AKfycbxvyHB0pk2Ni3NuI9b9uQIEcuTI-hqqDzcKpSqqyP44hqYFbCMbK2BmnHvJ2dwSz28Bqg/exec

Analysis

max time kernel
121s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2023 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://script.google.com/macros/s/AKfycbxvyHB0pk2Ni3NuI9b9uQIEcuTI-hqqDzcKpSqqyP44hqYFbCMbK2BmnHvJ2dwSz28Bqg/exec

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
2520	msedge.exe
2520	msedge.exe
1812	identity_helper.exe
1812	identity_helper.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe
1048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2464	1048	msedge.exe	85
PID 1048 wrote to memory of 2464	1048	msedge.exe	85
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 4868	1048	msedge.exe	86
PID 1048 wrote to memory of 2520	1048	msedge.exe	87
PID 1048 wrote to memory of 2520	1048	msedge.exe	87
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88
PID 1048 wrote to memory of 1476	1048	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://script.google.com/macros/s/AKfycbxvyHB0pk2Ni3NuI9b9uQIEcuTI-hqqDzcKpSqqyP44hqYFbCMbK2BmnHvJ2dwSz28Bqg/exec
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa709946f8,0x7ffa70994708,0x7ffa70994718
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1784 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,18438640468891679365,14806714606725709906,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
d129f04f61bdc80d68497c4fd5f502ca

SHA1
856d9f019ca16e8909c7b49c5ba2281f15901048

SHA256
222ba503e783da73a5cd8fc54fc268c6fbf473867168dfd93b1b000b34b0200c

SHA512
cb782bd6a5dedccbcb8ecbc4b8900f945c1704f311112573ede3edb2ddf4f95f3c16aa7fe867a62ebb0bb6ce9b753855c7ed82923f75a8022f8a33da73479509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
b746319e24aa1a9b02381278f3cafbfd

SHA1
b6e997e9601cd3618b36dd19f2926e21e2806581

SHA256
d716aefe9a1a78349bf9ae74f11a6aba6e45bac26e24bb333d0e4a614674f3c5

SHA512
8af394f0c5e9631d8a36a30be52ee30a7b5f27aec9a3adc04c3f2641cef62573541e6565eeddb99edc56555bc3975640444f221c2db1a50b5908f78cef954f16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8e1f2b34230978d422a936ebec7b56c9

SHA1
7e5f6b99820b428437e03780e98d29137cf93c17

SHA256
26ae6a1abe1b911568b21c0f7ed8fcfc691709813f303648a6960a43c9f19891

SHA512
25bc08094292cf0e9071fb316d1ded01904fb2c721dd0febef61fe493cb446848a3a0a3c146d5914cff9754ab89d9c9dbbb01fb33a6fbae8d4057186358f28c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
187cfd710d3dcada15ccc50c3cd20448

SHA1
447230c12a091d345f364f01dff8a1cef82196df

SHA256
6923e30f837fd77c903b2b23988710332e570058662cc48bc3ca9f4c298605bf

SHA512
3903d25dc871da42a466c056e35987557b8bdba8e15ac4a11d529fc739287a5824ed6d5a53e3df9de765276ac31b25b647731ffbb0e8c407851d5752c1ddde56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ad3f444a6303ae40fb96f92dfd2d41b

SHA1
99d707378094767587f59ae8384dc307af457825

SHA256
87721441d266cf419309fac5b1cbae7df29d63c3347b2aaf2e31b83f5454c763

SHA512
4f8dcc5cde102cf834eae0bf300af97b9e43af6da966583780779da9ec31bf2e1b0b537c9f9f656d34db8e1d156d1ef958a2249bd19c9a0c80e5d6e3e53ced79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8601ffb38b4599cb3e7ba84154aa2241

SHA1
81136529b314abd522c81df153a0e0bc460ceac4

SHA256
95b1c1466a8006f5a2f7ca56ac7485865dd6fdae00ab8d1ff40158091be33731

SHA512
3f5e42e2f6edb8662b2c5dfe634e2241a813b496abc7d2a71327356526ca79f43aaef881ba74cd6a60f1de5fca7edf58514a1daca38cc5f3354c1f3f7b914941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9452f2260fc6502f6586c12ffa6c4742

SHA1
a87bdf6ff2bf321fba56257ed572e5b6a40f3b32

SHA256
9e705fdb0630efb63cb9f34d7f37411725eb6ca4916d523f3202a48051a61b3c

SHA512
c2b0236e1158ac5cdca961faf911b1d98c420e33f6f12e8e269f63f42787fede164e6af450f7c40e7c04e06f0f5a430d524be07aa5e942354c0b05e36616ad23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
56681ce4fcb7569361e6f046f249d6da

SHA1
7f89985e59ce5d9cad11c0545c58c2a2723b65a6

SHA256
6d53565b4320e9c3ec18d67499daad9a6ffb54a95727f5918e179f7ad4916e09

SHA512
e70210ebcce3cf6c037d9950cbc266891f38c3c73e1e9ba36f301d0150985b5cb38186db0a83bd3f9474de3d8cc617bd62c8a1704afc4cb021d06eaa88fe9583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
2c77c1ab7b0cd6c39556b3d31dc3443f

SHA1
15b65df9e8ad0ffc5f62b74aa25a9403900051b4

SHA256
eda00d0a69fb6693919b1f47ba503e5dda79a59c247ce62e08acf96c75a2a28e

SHA512
69a20940e7fc9f2a5018128f55c82c0231ab675d9ae36c14261dfe98457c065beabf3d553f6ac16897b81baf4cc66c4bac599ce1d74762c65c1a1a7dccda0ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
133eae006bea767a108313095449b68e

SHA1
ab0dcac65bff1b7a266f57e0a5b559d265b768ac

SHA256
33f32f1b7a7eea2ca2016de7635de181fcd00d632ed5b6262158bd0cbcc9889a

SHA512
c8c84673f93a52f11a16bf3feeb214258a815b72b6abb86b10bad0b27a1d043dcb82170ebf22a33610b7a9b4fcea54f22b9067cff41e7f73c3b3b4e0dc20182b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c8a74b06625f0db20009a9e9b4623963

SHA1
6e8ccb7e0911830b9f51343813bdbfa0bc2da830

SHA256
f5db9af4e80c8cd1c90a3be600329bbd4c40779ec029263d91e91bfc3ffe0f43

SHA512
7c1a0228821663e57bdd93ec4979fad0ac61bfbafe5d9a49d1eddeae53a78e283dbc1795b254c4abaa7d7fb4ae4b4d382433fe8f29fdeb4cf5652fdc153669d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
812490d7be1b9168798e0fd46edef579

SHA1
99a8890c9ea57b7e03a36f753c075f6047ce44fa

SHA256
84eccb0178e9401010734584d245d2075b3974b1f436b7b1e171738c3f53c037

SHA512
a7fac1ea101a51ac55d004559922a78466a42237cc570fe78a64e6c914826a587fd6857318d1c3560de01eed48103f1dc63d72db05c2573d04918e501079d640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583d91.TMP

Filesize
204B

MD5
6194193d52f6fb1a8a73a79920513e09

SHA1
21dfcf9829b7f3bbdd34f367b59314d3db3c26c5

SHA256
35052d935fb6c8048d8d17d59a869a64e74e84940646d4a2e5a2c61140da8784

SHA512
6e1a3cba5cebed32907c213e3a95493c0bf42de71d903e7ee613e8a64bbb435374515f72e4ac3b486a7108219b9af6bab5751bb241d34590aa9118a83c2d672c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b018a466e885eb101847216ae2a84acd

SHA1
fe38782c39731f855957db85749fb7a74fb8076b

SHA256
6f46f6c2af03ecbde5646f97ff860a434b4492cb14b2820977ee1d2ea8710d0a

SHA512
2f4e18f5576ec86e515a9468707c95301e2aae345d6cd5968415aab0db44751cbeaa913910a9af1bf95f913dbf598f63a66a29044f8a5f007ab92817f995f4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3b59ee6dd79f1cbdf74a92507fb83dc3

SHA1
0c0470fcde893b0ab655f4c88029ec686d399b4f

SHA256
1f455811c3ce650b2b9532c40fb15387064810a1f7ee78ba5648af98ba6f6eff

SHA512
fa7cb36382a264ea0b993f2e951bd2e5465f4ee876b5d68c3ed6b9953b09010b0594f1dc36c69194877612284ee53e3ce441134033708b6161e644ce0becac15

Download Submit