hxxps://drive[.]google[.]com/file/d/1_eDY8Gw-nl7fxUwDXtNIxRLtSW5Wd0W8/view?usp=sharing_eip_m&ts=651f5e8f

Analysis

max time kernel
34s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2023, 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1_eDY8Gw-nl7fxUwDXtNIxRLtSW5Wd0W8/view?usp=sharing_eip_m&ts=651f5e8f

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
2944	msedge.exe
2944	msedge.exe
4236	identity_helper.exe
4236	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe
2944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1788	2944	msedge.exe	82
PID 2944 wrote to memory of 1788	2944	msedge.exe	82
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4460	2944	msedge.exe	84
PID 2944 wrote to memory of 4920	2944	msedge.exe	83
PID 2944 wrote to memory of 4920	2944	msedge.exe	83
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86
PID 2944 wrote to memory of 3560	2944	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1_eDY8Gw-nl7fxUwDXtNIxRLtSW5Wd0W8/view?usp=sharing_eip_m&ts=651f5e8f
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc225946f8,0x7ffc22594708,0x7ffc22594718
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8227662961711677480,6844962149492981538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:5772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
6f877ed82531241eade7e0753ef053eb

SHA1
ddf5cb5eed4941fae4d7642c4bc97a17618f11c5

SHA256
63bf731effcd0c7f26ff323f025277171764127a48b5c6fcb7a32056f063f3b6

SHA512
5e90af88ce889b1e64db22e322f092603adc025da29697a93c14356f632ffc67cc379e635fe5a1b45be1ce680fab46ae3886b331d4e30f38f9c54fbba7d12fcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77cd1cef68bcd5f9e1b14d3aa812dc25

SHA1
228d1fbd74e63055a615bbf9c89315ac586e98b2

SHA256
5e5a4685038cb99889b35822d71c196a7cb1455e7fe1b0333173d3a228ebe20d

SHA512
5ba8a0d79ad7aa2ce07dfc4d41958303e51a2d2d59634df7494259fed5e6dbccaae20de66d9747d51bbc3488b9190a8bcc39a0113a6b7e5150f6e2c3e5f36392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8b0cc183bca50fcc1429eff4fc734364

SHA1
eb9d80c8566b7f16bfe528d72f861c0c307f28cb

SHA256
31e1c1270ef88ec482dd7b85f70770cee0e6b2d44b1a05834ff523d857ae2145

SHA512
582f3245ba23b2461cc11afdb01437e516846c242b773110062119a3dd27e75329c96a15dc949891b7b7d690f8e80429babfd501b7d68612544c5fbd09ee9f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
17208c2f29ee311356455e15851c28b7

SHA1
581f12c7773d5082c9dd8467444a5a41bea6ca35

SHA256
a5c3cf52042f6a882dd21637b21bce5adf819600adf187bc03e297153e6dd9d3

SHA512
eee239ea8254aefbbeffd326d8053a84098c2a4f514d6e753160565ed429ad43485e58e7cd9d172eb39c8ed4b9f0f61ddbd50215b6b7e9f5d0ad188da6bf2d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
94cb9c074897d6b1ec29768b88b1197b

SHA1
c8e478b0f353e35ab686469b96a240f5e1a5823d

SHA256
c44a114004223fc07cf9d0abc1bea929436c64bb1c51d9adb8325aaa822a4566

SHA512
5642c9a28433e66b25d768da498d054a3fa478d6ca42799be49926e5242aea1ff5498a5cb70f59ee756e68aea3e791570734af85a04c94aaa3fecfa4a71c337e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581558.TMP

Filesize
870B

MD5
d207a7652e09195e301aa25ecd5f34f5

SHA1
8001a55a83e0bc09084b9b92adf9871f6f0385b9

SHA256
8aee32b34c51d09de94f8380670bda8ed44130b63754fac27ec6682fe75f39f9

SHA512
57f4c3d72920eca4cb5fd80987890828dfbdea60279beabb98443c4d61bebaf0dc8b417b3514ec31f4af5845fc88e0f80b1464bc42acf51cea70ca2b813fcb8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
989097f351f1c8dcea5fec4786058e87

SHA1
31b27b9064fe902b3626fbd67e236f9badec4eb8

SHA256
850021f7a1430e0eab2784d10c5f8867b63b97b50f30ed6d4b1125537381e7cc

SHA512
dcf1be9cf33ac4de60fe8d210a14bbed2db305942c0f2f801964036f2523ea9fd55f35be21ac06a019ea5410759e60d4ee4cc57cef9557841c71ab6628be0e39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca5dd80cb9419ad5f50f71fec173a625

SHA1
afa941c5c502ec002180cfa11c4a924773698f6b

SHA256
f4cb5b45cb4570d8141665e3f62250516885c7f9f9c5a980c4a5a89d59cb7c4b

SHA512
616850db7dfabb8b7746008eaad0ade460683f358c6ce96bf7bf7c47cda83409430623795aff0b29461116dc44f537a0ac39d2bdf89a3983571554d74a79ebc8

Download Submit