hxxps://drive[.]google[.]com/file/d/1ydQUHJoDITEKKpM2T0V56XdUa4yMWcTT/view?usp=sharing_eil_m&ts=65304d7e

Analysis

max time kernel
264s
max time network
268s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1ydQUHJoDITEKKpM2T0V56XdUa4yMWcTT/view?usp=sharing_eil_m&ts=65304d7e

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
3032	msedge.exe
3032	msedge.exe
3704	identity_helper.exe
3704	identity_helper.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4972	3032	msedge.exe	57
PID 3032 wrote to memory of 4972	3032	msedge.exe	57
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 2076	3032	msedge.exe	88
PID 3032 wrote to memory of 4552	3032	msedge.exe	87
PID 3032 wrote to memory of 4552	3032	msedge.exe	87
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89
PID 3032 wrote to memory of 2140	3032	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1ydQUHJoDITEKKpM2T0V56XdUa4yMWcTT/view?usp=sharing_eil_m&ts=65304d7e
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc774e46f8,0x7ffc774e4708,0x7ffc774e4718
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16851303976689164907,1133667861157318916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
27KB

MD5
515f7c67faa84e6d1d47f279e6ec018b

SHA1
4c32197e41dc32f86f8bfda6b6f27b67ef0be97a

SHA256
a4a11287edba91dcbce47ea34273f69cb344f9cbe4ccf58aeccbdf4570f8ca32

SHA512
a04bb831add87ef81e58324d5fbde9df22aeef400db680392182a6b4a440c24049b2c3cb50e77f4febdcfd954996304743773d51b0f035ca06e66ca6b9e406be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
81c589e6993598232015cf0308357ea6

SHA1
b92ff5ad5e023b46fc7497307dc8a2c55b3ecd0e

SHA256
0a7a52e154967db6c452d82c4887dc7ae5032430586413bd02604ec6c5c74af2

SHA512
4a9a67ac4f6b7d1dcea3dc80cceaae6c3e3af01d12529fbafa650ffe8d3218fc9fff9cb6a743be3d0338c3c968902b1621ab41ba7e8f8de500a3a4708e165058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
50997074841790cf2f00dfd98f58d153

SHA1
df0407bf7170946af7171b6bbb3a9b2e73334081

SHA256
e3a5e4ba29050923ab02783fb880a3a17435ae1427b84e14aa03370b85081139

SHA512
b6a64723715d16c32e031f5aa30c69fad84c9a0ab498ae0bb7d12079c8569ad9f29f15da9b4fe7ae2be0ab978765ce194adfb46dd80a515b2b3c83d9aa6c858c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3f8c885f8b8291ae118b3cfd7f5c4336

SHA1
c3693f844bd84a014ba98dd354c678c877131dc9

SHA256
6f25abaac88ef6204864dbc38fda3c39946853131cf18e8e329d16bc0dcdb7d0

SHA512
cc92948956073e9b191494f6a2f31caf71029bea1a96aa78e231e63db87d853e82955cdcb076e698eda8be87f2b9fd973d551166110a1600f6c00bbe3d54222c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
103067bd5b353ff610591e077d73c870

SHA1
21050da0f77b0482963ed05b963a693603fb0c52

SHA256
27849e202cdeaac486a5919b6dc31fdfd0699de6f4e38ee2b579e3959584a139

SHA512
5571f3d582c744cf254ef9890c5a318dc48cef6a4b6fc1fc2556ef596e1cfe8b098fc0b00c2ffc6458470cfcb777f9ff1f0dbe2d434cdf6fe67f61ca1c83d28b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f405413b8ac18f82f2582b265192eb4f

SHA1
9d075e167e16eca4e694fb2567d0d6cd2044a47a

SHA256
ca82f80c36f36fff695c1e0e309dd0999e3c958df7d472432f5cf697575b905e

SHA512
14890cc575a857fc21e91846ddd51921036240e526d385cf59ee6f1b4b9432dfcec077f6155b4cca2b3a9c26d7e6378c1af4bf8e3dd73e160037b4a22e71969d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
08aa96e27fa5392e96b6cd953df615ae

SHA1
c9b01aa061b4f109402976a11d91eeb69521e735

SHA256
7afcc7d652360709bf9cc215e4c492e0486f9018d5eb84a381ca2080e12e5558

SHA512
a9edcd1589a0aeaaaa89839ba581e46daf5b3f8bd854e158125eec54da615365b0ff3699e0ab1d13f18804ea70b6da6537e8450d717e1c889d640b70e090a185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65a77acd2c57d77cb43e414478cbf5e3

SHA1
b36875393043466b7d41c8964c728317f6968d7f

SHA256
170bd35657c5f568f091392c6cf06e64d1249514a243fa211ebc7fae4d324100

SHA512
64a49967ca361597a27148db5a0af4dfb4a2674071a4805a027d6816c4113ae9bcde74b92ae2d0ee6454a6dc6f38e0f2f78245aff50a700ec685ea9a8ffb483e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32f11c4b06590e5df36af8364fbc06e3

SHA1
c318fe1a98f4ddc9be8751ec3d24be465775b50d

SHA256
09e522c1b563187721a40169f953681636689cdf9f8a30cead014c5f0a18b8f9

SHA512
a74c33927fbd82b7f2c2c7eb5cdfed8d3e84357cfa68817a5410c77b0d094d3dab256c2dbb3e4283dda40629e9e358588a775cd219bb0fb7c0f4665e9f882cd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d6dae6f2a1d4be215b8dc97af9e6747

SHA1
9e6a064479de6490a629db39d8dfa728cb4d37f5

SHA256
e87fdc3565bf1f4eb797c6e58a02e3c08920e0e0356dacd5b8417fcf934ca143

SHA512
16126023ded50a718d1e55b8056c413eab0be6c6493cf5b772fc15f6016fdf8d70394a90687ad2660eb5aa5556123073bd24256059beb1e5f7e28ce341941732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5f72102a846eab450fc383bb96da947d

SHA1
42bdd65cf80bc053dea6ec2b8d473c25c4fd92c2

SHA256
752e9a692cb4732a098b52f0e994174ce283d41103d4abde9188d5b6cbeffa3f

SHA512
6ba3d2795cbc190d99cc67a761c5ea4f485f65d34fa0be31b8c33d84593e1a4ca9e98c5a1add83c2ebc935124e6efa7ac9c9e992604ce08104f405b4fc5a3f3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
79939190855fd1dae77680304f800e91

SHA1
18515687f7c749182ce6c922bd017e369d2a0e50

SHA256
3e019217c428b188c1a8fc6b04e44626725b48430c8c39acefd6cdf70f5a39fc

SHA512
b89dc862d96ad7120c04c4429656417ee0a2e12c00239939b10aa053e26fa382ff6f2c924e6ef29c3b266aefc3aff246736ef098572d9528e2280ae1ff6df5a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57db8b.TMP

Filesize
1KB

MD5
08808564c0069f44d352ea553b92b159

SHA1
8c7743916f4f06505662dd99d2a76405ab5c0165

SHA256
c6536f0a96d826d1dae4d1c9ddd5f5ef93559e94a043c454ac702f694d32d9e8

SHA512
8b2f2196cc0c9f0a6dead82c5c10c5b5d54d75a2460babc8cd20c63282891f007a20fb16cc6fb665fe0e1c12e9199357f14eb62a0e66ed214226bad6f1d7dc6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c852b2ff6cb8d6c293ebc3365b55ecfe

SHA1
9032d16f3dd2b1f006316c44b65b5fea5ce8e327

SHA256
aaf67d40bdda0fb031a01762ad9dede8f823a83c32df653c3e41324bfc57953e

SHA512
288a76e399c3a320f317a013321b127e925645efdc90cd45d66b4678a3afdc5e4edf21a33f7053e5e007c6e4749f0c9f1a657bf46e0b01cdc62c0c425ac7a4d0

Download Submit