hxxps://docs[.]zoom[.]us/doc/1xfCGWrDTt20rxjwK7r9qQ?from=email

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17/10/2024, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docs.zoom.us/doc/1xfCGWrDTt20rxjwK7r9qQ?from=email

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
1044	msedge.exe
1044	msedge.exe
1840	identity_helper.exe
1840	identity_helper.exe
4324	msedge.exe
4324	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1336	1044	msedge.exe	80
PID 1044 wrote to memory of 1336	1044	msedge.exe	80
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 4200	1044	msedge.exe	81
PID 1044 wrote to memory of 952	1044	msedge.exe	82
PID 1044 wrote to memory of 952	1044	msedge.exe	82
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83
PID 1044 wrote to memory of 1740	1044	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.zoom.us/doc/1xfCGWrDTt20rxjwK7r9qQ?from=email
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe98123cb8,0x7ffe98123cc8,0x7ffe98123cd8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2628 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,288487380098911164,11992091114675077396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
215KB

MD5
1585c4c0ffdb55b2a4fdc0b0f5c317be

SHA1
aac0e0f12332063c75c690458b2cfe5acb800d0a

SHA256
18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5

SHA512
7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
33d9176c9241a904b714b0a7c1941464

SHA1
d1d83846c8994e16674c82d80d66666392df67fd

SHA256
23647afcdd1056144af22658bd26cdb4e4124a5c6331d63d4bf3f24ba1c1271a

SHA512
2b7034a8aec2645b34ef0ee7bcf6631ae7a25f1b00ee8641945d76bb3ad7140b597361b990b69471e7dbbe2d1d6d5ef4b6829df90068f10615457ac27f6bbacd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4d943192946bb3d11abb5d0e84db44fc

SHA1
9b9b1fefc5c379a5225d8de45f371f5a53aede32

SHA256
2700c220b45bdfdf4f3a708b77ca700e5c741a790b2b5c508111bcf2000e909f

SHA512
a7b561e363d0a42b8ac0a958bd0f639b222bf2374a55b79c9f00ccf9c13b7c90df2e407136eb49400b24104f12603b01ae131fed2afea6e13999efa3c1939eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
f7412daf909fd119c9b320bca9698589

SHA1
9676a49d9b6ba85ebcd85d8cd8f11a5b1b552de2

SHA256
79954526450221e40c30b45309bdbc3c25667579095e802e32f8dfb37752f913

SHA512
66c2e47f2fcbe8ee4473396ab6cbf992a3cfd1baa85609b980222659c5664643a9374d2622ca5483e2ba8728e2f64a97b371d373904f1c5c14db7f31b07d9fc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
96046971480429d56b12bec346233881

SHA1
b626b522c08b950626acf88b9892807cfc2cf39d

SHA256
4fd12a637fa02c0e704dcfdf2d81afb1bf4b707b7034c10ed6bdc9fa5381d651

SHA512
b8054f425ef696aa3c6498cd2546bbdfa409d47beeda88621658793274005265bc38c7587f08c244a1b5c2fb7cc90ec301afbf8cd55cc1f456bf7f69e145fb75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5f19689691115be3509879356ff571e9

SHA1
0ba650270b1152c127d65bcca0c9cf42c60c4b7b

SHA256
afd4706cab90a26afbdb1bdda913ec66d42f5b3f46163e22f6e92104901df2fe

SHA512
498c61f25962c613f67f79d0640b79209564c01d1fa463b647a7f688f164b7742b99522fd2f6032d8147d9f72dcf2f0606fd026dd5521de4d43431bf954f6e04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bf300657c7757972d67cde8bdfbbc20e

SHA1
d9e393cdc8b5145e57bcf32a5466da3041ca6630

SHA256
b81df33b84480585258c76fd53e784155c51d8990837f6c6f9a96f250ff713e0

SHA512
0282d90c8b153b5588da59f37346cfc466a9297ef02c05f21946d36f8b0c3b9f6ba61808bdbb5f1007af0386025733db79c01edc35aa9e172d9f1df924d11718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
8494e5b954c4fc7057ba779e34799ab8

SHA1
45b0871c542239349dadd27f4e17dd1813d8ac74

SHA256
ec1138687354a9bf9f657645d7701feb6d75a709c0b51cb401ef0fd77b710a0b

SHA512
297b934fe5c3783bf48f7265c4144385f3c0d2302976782e8c99c97ab0cc08637bd24facdfa14701b4776b6650f44a2c5a4a9f75d6e932d756b9547e8a31d342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57caf1.TMP

Filesize
48B

MD5
587158f95a517e3e9ae948325ec24895

SHA1
0b9ffa56714317ae489c59f6374a09aa9aab7acf

SHA256
d986bbe09a9d225b33bec4b85c310b66843ab129801c0509d030af7f2ec62f15

SHA512
4024953d6f59136dc5b73f10ebb9626c5724eb8d93b9efeb78b13fc47e8d8dc9dc094920487916a3a54cab14f8fc87a1743640cc0b03d320932e0e770a3d098f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6d1200cb0e710bd52274987c3168c977

SHA1
d14ce650d83a70c2228e7936527fa91fe7e0f437

SHA256
054df9ba9ed372b49082ff1c2e13d421d03eae0526894b95bfd9d6703113d1d7

SHA512
0596e2bef0ee5d55ea8a9bd9d1c2c50d581551cfb61351d32280f8cae5d61d4af05bd7a1271116cf6cbfb15cd3301e4dfb188779d3359a45e1f9218a0152ffc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9e50f3bf4a08797019713cc481c78e71

SHA1
ae374f3a133f4e56e182b2bbbb26d3fc78a4cc30

SHA256
3b6a847cfe32eb0b0b36b134b7442a600245c727942518e38dcf5ed1e292b296

SHA512
717d1d50028bafae0ad55f6f3aa8f8409f76a4f275aa327c74b9f9be8c6c1a6b1a5139bfbaff85cb7b09f6ae67c7f2489a1dfc658efe0c42770da595c99820f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cb2f.TMP

Filesize
3KB

MD5
20676f75d88e22f79cb7c4f28bd737bc

SHA1
793fb3ee4783ae7bee2b28fb1d9ab92203ebf8d7

SHA256
7c43d8f9c1a10f5011875596a39a6feb2583a2c9b99324ff2642e1e736aa6061

SHA512
ed73cf561d6a90d0b1e34ec797d621dd806addc310c7cd9278c7b78cff16c681ba2c464b257eef58c3b2c8cdd753cb88faf1b0716d58e8286caa7a8c8cb0132b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c090be1d40494e698ec0362e4f07ce85

SHA1
9b6a1063266fd66a6b8cdaff670b0a7a308eb44c

SHA256
f25c37a754ee0f6870f771310cf0f1f856f2603c1e9370b8cce03753e32dfbf7

SHA512
9a0d1c824bef5d98911039dd06c9c2fdf6423b495ca33f1b3deca621a8f4bb067ce11f11a961dfc21c0fb34d0eb63549e25398b422b83e3db1504499bd5b8309

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit