hxxps://drive[.]google[.]com/file/d/1bAceOkBMO1_R-GqNxoTosCcyz3viHNuz/preview

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1bAceOkBMO1_R-GqNxoTosCcyz3viHNuz/preview

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
2596	identity_helper.exe
2596	identity_helper.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 3448	4184	msedge.exe	84
PID 4184 wrote to memory of 3448	4184	msedge.exe	84
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 3408	4184	msedge.exe	85
PID 4184 wrote to memory of 4284	4184	msedge.exe	86
PID 4184 wrote to memory of 4284	4184	msedge.exe	86
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87
PID 4184 wrote to memory of 4716	4184	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1bAceOkBMO1_R-GqNxoTosCcyz3viHNuz/preview
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf28c46f8,0x7ffaf28c4708,0x7ffaf28c4718
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9805767756522693806,11888283586315499497,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59427e87-2c7b-40a0-8210-93acfaf17007.tmp

Filesize
8KB

MD5
0c0efca42aec272b868f057dbdf0d78c

SHA1
15eda3c086d5b7e36c971a8218771edb93658e3f

SHA256
870107efe3feee2acfcc1bf78050fa83e845078934bc5ad38cdece7d30ca34f1

SHA512
469b459c10ac39009c9ff171f17c67cb8caed1fe67cf6d4727b3aa33af7e95fa1140f51367f53c05d1965078e200497b9fa0329e453fde9d8f4f147c48060d86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
4e5ec0ae9a8aa75e5ee0cb378be80ccf

SHA1
a4bac2ad093c7b1a6a1af44fa48c790f890e686b

SHA256
d386d4ff82c734219fe227927cbcdbc9cb37e6a579fc61d3d651a545f9a7518d

SHA512
03100400c603574ede7f9d2db8b17eb0e1f445493cdcf004df27b584e9a28b2dbeb2afc2367a6f0b8d1eaca388bd0b7c64ce8bedb817394c83591032a6039cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
be692be766852ddaac8a1dd298f2aa41

SHA1
2f02a56578a1e866f186f00e68ee8b9cfcf3b50e

SHA256
3c55754538dc1c1d2f4fa396661b97f578394b2bbc5c6057643f64f7a0d62960

SHA512
c1f44071e5e171451fc25f096cb2a60af3256e54701d477612af0296e146c1026b8f067b5a990819d864cdd00c2f89e8097222a0716ccd93af9e6bd20228a8c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
225d519fdd52439c00f1c755e365f069

SHA1
ff742531a6a6cb104550fc214ba54bc630d3d77a

SHA256
3f592d3aa8c92c015dad2b5e9ecd08ec5ad9bd0b310f4602c7071732560df3ed

SHA512
98b8ea0f505823e5e299b90f96d7b8d4738e2ce6b790d4dcf5e3f69cc9c9816d16acb11932fec84386055b1919e86d0daf8eadec73bc939296795929d5e07a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
07341133ed5dbe2e5353641385f87236

SHA1
061b0a966356b20e74643a8631f3882a638c8b18

SHA256
7888f03a8545c1da7186ae5729dce470cbd3995ecdedac6a020a1b5c0ef2910b

SHA512
a7bfa5a11e9d8d670df9a88f40d6b3781c1d01c93ebf2a2834bed3d48b4867a1978ea7ed40f3d1d4c1bd5c52d6fd25b964f7e3ad658709494ab9edcb7a8d5944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31473758412ca40ff1cbb325f87d0ba4

SHA1
4563d611522bab2f83af4eb8d1f6689deee02c39

SHA256
df85965466de761d4618df194421b981b64962db940b3b138f35eadd4e93ea7d

SHA512
da65033fb22ed64ebd235b971cf6b708daf016375d4457394a9127e462980bbcee31a0ae253a9f5351ea1aad4e976d4f28e780aabac010029a81c3cc46ad4a94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
892cd0ddb3f3c40e085c82567d850226

SHA1
9e91328e397109fe51595927a26a7a24d9b42b73

SHA256
b6917af9eac6ec74a24d5e16ea501640ec63e1648086f963c9bb757770761099

SHA512
a1dd17b6401de0d5dea99b692e11b8379baff8c93a152d4a4509fed80939056c80015ff41f3dda4579ee562b7bac25c24d5727c5c07fdbbfb88c2260015d470a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f41116d68ffb256e73bf3d20c05ce549

SHA1
ffc79c5b25f811e71d56f0aa01666a627bee8473

SHA256
be2196d995458ebcda8e043f7bced4c6100d5693f495751f09e26ff599c082ad

SHA512
3a26e8623a8e6eb93c1484bad8fd7eea1783573336851eb15de25a37ea386dcc122175ef5e08b3081bd8b8836c9e4e1cab39558e004594f97fa87af1f259238b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
79f9e7c2daf695cc13089b795842bd39

SHA1
7a34b6a79fc645925dc718287621f1fb5aed0c5a

SHA256
8c7531652c0a5e1e57eaa6b77d83fc2e5d66b496a38800ce8721014b1bd222f4

SHA512
a31e79f313effa13c07cccc4d44f62891d6c1f5c30772eca7adc5bb4be729ad8837178cc236bf9001ad24ea22db862e905e258cfaae5d7fc255a5416bfe087e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
777cc8938b4a55a46dfc5bcd84f8af6b

SHA1
db8ccc11f773ec95247439380ca410e14e989119

SHA256
b0f9e98666bcc7d09407cabc647517cb891cce46f77d36d63ae762d7c96a2bcc

SHA512
93f805d64f8707f21eae812d9b5fa47f7923d78b1e3bd06bffb41df8c942d99ee602e925ef8401342fdea88aa06e4a83672607b7a9f7ac7bb8a1bb2a1d8b04f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f58b.TMP

Filesize
705B

MD5
005a37de974f386775054549e450c069

SHA1
0d99279e1f4bea17c780a79c2ce21cf92a395dfe

SHA256
debaea7b03fdfe98a99fae99d7625fb8334ee1282feb8f249dcff3c024681bbf

SHA512
dd544758e6a176bf32abd0d5ae44e6e642927917350c13624adfd5dd33b23a18cf1152087e4953a1fbbed893aaf7b23a3005afaf8dcac2c47acb79cf967d55ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
47e3a9b836b3ecf4cca32c01d5f45c79

SHA1
2419cb9cd19cb530208004da99cc2b1901ffd5b1

SHA256
d1cd1bb05ecd4e38a704c7c5a415bb25e8612635411b4ad7bc59f7723f2554d9

SHA512
2dba3a528e5b70ff52134213664353eff56ca75b59d95147558dd06989dea10b525b723e306df46fa034951a4aae35503f2699b27d6c7749005ef0948cff8a0f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit