hxxp://docs[.]google[.]com/forms/d/e/1FAIpQLSfQJGd0q7engCRxCCFDG1tkC8Fvj_J-ctA9HbdBnRQf1pZ-9Q/viewform

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://docs.google.com/forms/d/e/1FAIpQLSfQJGd0q7engCRxCCFDG1tkC8Fvj_J-ctA9HbdBnRQf1pZ-9Q/viewform

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3380	msedge.exe
3380	msedge.exe
4608	identity_helper.exe
4608	identity_helper.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 1396	3380	msedge.exe	83
PID 3380 wrote to memory of 1396	3380	msedge.exe	83
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3808	3380	msedge.exe	84
PID 3380 wrote to memory of 3936	3380	msedge.exe	85
PID 3380 wrote to memory of 3936	3380	msedge.exe	85
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86
PID 3380 wrote to memory of 4168	3380	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://docs.google.com/forms/d/e/1FAIpQLSfQJGd0q7engCRxCCFDG1tkC8Fvj_J-ctA9HbdBnRQf1pZ-9Q/viewform
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9b7b46f8,0x7ffa9b7b4708,0x7ffa9b7b4718
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,10880921873971952554,8907439306961338112,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6837505dae817f02bbb549d3910f76ec

SHA1
4bead1243a3ed4ba876f30031d11b7fcd4052b84

SHA256
997f7c6bb1805cb785d5c0ce131c8cb2362e6dc77efb38c3980f69b7a789a649

SHA512
4382a76e27e70b6ecc05c14e9a1b915e36ca661cb868042b28d59a7d807ae1ba069aa0e734648225dee2b6dc33626f58ee24df1cc451217fa093f46d5df616d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e15f9acde9d56006be268b4025f94b5b

SHA1
5d36b646b34f0a1d08b6020f12e548db96865906

SHA256
045480199f3befc5d2eee18f84e92cc5bf8881b76ac168085a987878da798e0c

SHA512
22d43f812391c9fafde0a4e247212e491765e8f049eb56d692f248623b7a52044ceab8e6977675c343d502b460666bd72a4ea970f9aaa7a6b8a6c3a880bcc255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
3e42b4ddddbef55a9578b15705e1b813

SHA1
459d8122871e05aa8835701a4b1c9c445f310581

SHA256
d06dfb7863a89cd0262a1211ccbb71d194cff86931617511cd53e7c944370d53

SHA512
ad00bc29c8db7e648d198ff790da0811ab4f92fc4623d6099061c7dad7bcf9c24a161cd9e855f9253bda49fd474f6084f332469c81da4d340c4c695aca77fd40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
689adb1d599f5c5893c0ef72367f70cb

SHA1
9a0acf8c3807f5d8cfc85b3e5595b3a21c02a7dd

SHA256
04d9100ec4d1948f1690242557e6e69aae3cb91a66768bbb9d66a20546acf83a

SHA512
0fcbac0947eadf334ce61c43e741931486e7aca450debe7eac4401beb416f1ea1dcd55b669151ef7103fe4f23e673bd29a59cb02598d999f811c87606e7c573e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c0b33015326a3fd9160b890d434608c2

SHA1
428330e1101d8819e640336dfcc9293198b9ce24

SHA256
360a4ddc7af97d8681c4248c3cefc4f135a879f8635332508a6eb03fef8e6931

SHA512
517dd9b337f0160f04746052159f1f6f3b3868be76d012961dff3a92fcfd6bd8b686d84fe9d49d1d2a0fffd8d463334b397a4693b2fcc88e16ad19161f26141a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d2d82c839f2584e097b980e233581ea8

SHA1
7eb794bbafe07077191bc2062fa1ac64f132eea7

SHA256
f68e3032d4f81f609bce445fa210bb84e9768c987c9d4c7ba68c5bc71213b7f0

SHA512
fe91eb8c1633b631bb221238ccf94881a44c89dab8a0eb76a8edc30e827ebfa13a71816ad69110c420c65c1261396fc1c11ecf1a110d531119d7728ac6e9f805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bd12916c079213f6e9b5dcbde65f20f5

SHA1
fd41ea0eb90f9a153d2ad6ce3735009e6b810fe8

SHA256
ee0e8f2c58b313894155493cefeb145d96036fd8cde1f5360f2551ac2a556e1f

SHA512
563f25e968229fbc77a8695604cabb4936c053c6cd5c9cf083c6015e76daf00705ad49d1038b9877672c67043acf9a6b0c41611cdbceb13f25b99bfd9d7c23d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9a18487d44b6c9618f867f33fea5c74c

SHA1
08b44c77277895adc8e60e96378ed02bcd382595

SHA256
55a8aa84a3e5accabfc6b2ed36754dbf5b580bc8b2a98b7c4c783602bfcd3fed

SHA512
1e4c34e11cfe123b13c4b39c57d633645d3f70da7b21af650288f3b485e6d0b80fa789b31299195282fe8662205a7ac939de0324374097712872a5f27a64d3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b139c988683cc9bb136ef2f1f2d1f3d7

SHA1
a72ded529dee9a86389f0aadc8f4880f0de3bbee

SHA256
c8ab5c381fa00bb69f65ae32be1a1a648a5262d5dbd5101bb468eecf71b58013

SHA512
5edaa84c7b0d4913e9f31fe284c8d761bd2d99d990a77377b48ae232f1b7295a04241bcc2867b6e56e699fb368127e716d226e1680a14e020cf5228975809d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
70488ae49185b0a7dc9f98a157445f1a

SHA1
3467afbf5ff4009c1cd3a7bcd0ee1b0ccd1e3c90

SHA256
df02f9cd56868f634f2acdf6a4146168c7c2c351597d8e69f8798ea5cffa24a6

SHA512
02b24a8fcf7ed22547e3b388c160e466b1b2ac0d233150217142ebc315964cffb83f50847c08310c6d4801f321261ad830cf5ba0e1519e3631cf505d44982a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7c9e22ec6a604c58b9a625687c3696ad

SHA1
ad136004c7a8328913a3d389e553e8f343868a88

SHA256
2b54e98173d29c26a34405e84b228c32a168168e43dc6f45ab55507ce0d5aa00

SHA512
3ba6c9bdbf4b950fd6203e840cbd891a74c7414fc0fea2d44b88de2d5dc4d711d9b83ffe0934fe7aeac66d3d547c95dad4d3c49f733b39e4e1462417c4a0f9fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e311e8070a5db17b6cab425cdb01bd27

SHA1
ac533db7fa0902f34d02662fd029facbf4b8e8c6

SHA256
b9aaa4c71488c3a8769cee7cf502ab93813fd6df60ff2172ba8cb7e1dec86532

SHA512
87accdca84a2b2042e2c12381cd1bc0fb2d74bbb0c6a4d18f444212803ebc0b7184317df7f5fb3eac722d5d43d942dd62ee1d760f0b3fd18911df5bd04fa31c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
2b3b29cdfd36fb93db2ecada1986b552

SHA1
d09f96c160e7ed5380bda69b24c197b7389808bb

SHA256
19ed8800467663249baaa6a95b44e6a0f536649c41339ba8920833561f7a2637

SHA512
6b6233e7d4eaf333104133259ea6f7492f3bf4c1d59dda502321f8dfd911128cc18ba2b0f5526c42ebd7e2aa58f87dea049bfd728cfb418e3c8c0c732731aa87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e3e080a41bea961dc0dd8387eef12f69

SHA1
06a4a4e723b402d91d176a930cb02b9eb8f40f98

SHA256
20b3eabb94609a096f5a49f5140bf91ebd2415bb057573dd67f4f77500c6d334

SHA512
9638094978bcdf04680e8d7ca07d9ee6f0de18671eab22b555f2759bcf531f88247792300db5077e20770286b6be9dba9d54322d06ce6937becb114d93afbb88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
4006a2ef87dc0bb276b8318632ba7d6c

SHA1
cbeb08497b9a2fd0eedb4d5e12191ca9412f0514

SHA256
e71a006062d467a46aaf6e4c9ee853d1b21779d8cef811654ce2ebe2d6fc053c

SHA512
b3dfc17d6f01c63648a452dcb4bd07f8e8cdf546400e2e9451790515e2e81f080284c547435a8a534fd409424710186b0f709143f87abfa6613a96d989cfe10f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
d619e2ffff1063b6b560aaade2e2149f

SHA1
d9da4e9fce983478579f835ef75a620787f5b812

SHA256
28bdfa7715a32e083cbb459c4848a7a2e9f0f581ff51acbb55d0ac58d5680475

SHA512
37a364d55f0abff9cfa4bc27a5c996e07449cfae4a5dda5735d20ce744ed784cc93bd78ef2bbed51c95d88252b29d5d799814472dbadf386bbd46ae8efe2b840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581410.TMP

Filesize
202B

MD5
e883c88105611b672db4a1e1a2228ab8

SHA1
ab9ab2062d269cf04a7e9bdb37d11c61e3788c74

SHA256
b4295651215d07f230d08986cbb68b02c7b9492c492597cd916bd273603e8c0d

SHA512
d925ccdc3376b9f5b4ca1235213fce09c1da4061f7d6ee1f6637472d832b82b75dfb74826cd11d5d72eb69aadfc632dc43485d0b61b052556b6db04993c68602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b15cee9675cd5240b84d56702d3c912

SHA1
be208206f729991a7ba3697a148c19d513fef36d

SHA256
76b2368b1d1c09192362ca648d56d3d3076050de0e98ba81b7649a68b45cae79

SHA512
801e81f8a5e2344ada0625c2d02ee7156bd53854267209934b4f0099bafb0cbb1ac4a27fd7af85b417c88b7fb27330b78efd0c313302c4c7769c454dd849d50f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
11726b3fa18d26b4b4f7d2a693607f95

SHA1
935b16aaa8c68b813fe9a4a7b3771c8076300189

SHA256
3bbafd73e10507a0cacf24864f9b3e8745f0b19ef8d4e026a89a1ba197c421a4

SHA512
32af76cb22d5c0c424ffafa5447d9d771022bab1e767b37deec438f88cc054f63d4cd5c3bf5dee1efdc42917befcf9b2b967648b5a52b5988166bc1434e79dfd

Download Submit