Analysis

  • max time kernel
    126s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 17:59

General

  • Target

    https://drive.google.com/file/d/1iwqadzUuytVFW4DFgNuzAYtDB66KfSCn/view?usp=drive_link

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1iwqadzUuytVFW4DFgNuzAYtDB66KfSCn/view?usp=drive_link
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95bb446f8,0x7ff95bb44708,0x7ff95bb44718
      2⤵
        PID:1852
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
        2⤵
          PID:4484
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1188
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
          2⤵
            PID:1884
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
            2⤵
              PID:4556
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
              2⤵
                PID:348
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
                2⤵
                  PID:3024
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
                  2⤵
                    PID:2616
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4584
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
                    2⤵
                      PID:1848
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5548 /prefetch:8
                      2⤵
                        PID:4600
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
                        2⤵
                          PID:3736
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6272 /prefetch:8
                          2⤵
                            PID:1396
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
                            2⤵
                              PID:1168
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
                              2⤵
                                PID:4604
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
                                2⤵
                                  PID:5264
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
                                  2⤵
                                    PID:5272
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
                                    2⤵
                                      PID:5636
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
                                      2⤵
                                        PID:5716
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1196 /prefetch:1
                                        2⤵
                                          PID:5908
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
                                          2⤵
                                            PID:3876
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3428 /prefetch:8
                                            2⤵
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5132
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
                                            2⤵
                                              PID:4976
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3756 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5580
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1196 /prefetch:8
                                              2⤵
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of SetWindowsHookEx
                                              PID:3108
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
                                              2⤵
                                                PID:6052
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
                                                2⤵
                                                  PID:864
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
                                                  2⤵
                                                    PID:1184
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6488 /prefetch:8
                                                    2⤵
                                                      PID:4872
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,9916399081051019837,14342984343410397053,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5148
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:2404
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:2436

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        99afa4934d1e3c56bbce114b356e8a99

                                                        SHA1

                                                        3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                                                        SHA256

                                                        08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                                                        SHA512

                                                        76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        152B

                                                        MD5

                                                        443a627d539ca4eab732bad0cbe7332b

                                                        SHA1

                                                        86b18b906a1acd2a22f4b2c78ac3564c394a9569

                                                        SHA256

                                                        1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                                                        SHA512

                                                        923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        912B

                                                        MD5

                                                        cc9cf5519076067e1219f50697ec6662

                                                        SHA1

                                                        5e09361aa147fb31bdbe4ae2f7933b83d5db9bc6

                                                        SHA256

                                                        0f453a554ce0026ff45e4b10e9facc4263148c201111858a12b4a2f73453891e

                                                        SHA512

                                                        0138f76afb45aa9d81a5dd1b471b7b3f239fe4b4752acf01ae462983304c4532f68caf5b5474425b011a087b4c8ea338dd347d46de32e191c60ec2d73b5f7095

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        3ac0fa9c11a1b4eddce6482c4c578cf3

                                                        SHA1

                                                        54f90cb7cfdf520d7c159aa1c4c7ba38deb3e628

                                                        SHA256

                                                        2a3b60840b68389fd42c46d41183dbf9541f8731071e4954584f59fd27a7e106

                                                        SHA512

                                                        fae2fa00d0fca3ee69632af7ee36b2f3a2ce66d3a661dc988dd000702402da64ae70c2f825407ee3ffe0a1547fa37a315ef22584fb00a29f8622644fbf438c69

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        456B

                                                        MD5

                                                        ccb2248d390d4f0c84818f47a5452f0b

                                                        SHA1

                                                        c274b36a47d62b3c6f8b2e2f2c7bff8656138b9c

                                                        SHA256

                                                        cdb649de5a1d5cfa4f7395886e652323a5fdca7cf2fa5afd6d913d0bbc1c3ce2

                                                        SHA512

                                                        614d599bd734b2d1cda1d1771b102444f39a9f9be9b64fbef7760f652b788b8019d0a636d4bcfc3c8015dbea4c0d315952c191289968edda5754f4173706ec87

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        4KB

                                                        MD5

                                                        be080738816674707568919a6ef05fb9

                                                        SHA1

                                                        ff3a57ee31d36876207cc29436b9f3e4501a192d

                                                        SHA256

                                                        09d3781e680e387433f91868df7702c0838bf854e0ad739ce66ad5ff465dc1bc

                                                        SHA512

                                                        e8c880f1a7fff64482f95fef56dea6568e2e97590371cf40a69b5c70fd9024d063392d18c1e654d6afea3edd610a794fc2ed10482205232cb6ede1d43a9ab9c1

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                        Filesize

                                                        4KB

                                                        MD5

                                                        2b82aa2744a35011acaed9bea2d07afe

                                                        SHA1

                                                        99d37bc6b25b96fcdfa93e9f18ef268c3dcf2fa1

                                                        SHA256

                                                        5961d4850bd8cf877fcb858b108438a61df29ff4099ed9f562b7bb9c18d585d9

                                                        SHA512

                                                        05b1e2bcbb0816b519366948e7d6cf95ae8cc0d0eaf1501bac33d7908f5f08225246463920b26f65249654d8e8153395aa2c3000624d00b02ac93a42075c4612

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        c0ce4312311075ea3830a0103b225965

                                                        SHA1

                                                        82e766a504eebf08c4446e6e07cafe968461ecc2

                                                        SHA256

                                                        cfce2cc956272ac9b59fb33833b18e4d4db7a28433c8099af458fe3fc93347e6

                                                        SHA512

                                                        23ac06bb1181e0b605914235fec8caf951cfd1aab576199b4c564d5488a0ff2368ff792974f3ea3f63fd128c3c31136a1a8f2aff0ca37a4a0d951fe95f96836b

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        5KB

                                                        MD5

                                                        c627c0b144cd34e1aa4ca85740d4edea

                                                        SHA1

                                                        55a4cc7d1582bdac2205dc46c7663b81999cbf8d

                                                        SHA256

                                                        95b180263e22b423c9281bc6c2c99b79522faadb67def93e5fdcc884f831b436

                                                        SHA512

                                                        fc20e9ea99094b33c7c14571436648a9cbc8e4e884d743ed8ee61f3017b88f39a111b2f8e8e1b7a2cc278ea13ca38941921f30d62f0183ca608eccdf76667de9

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        36b6cc58f96841d4cb305e06b3378cf8

                                                        SHA1

                                                        7ddae1eb07a42e27e7fc4b03fad3e9ab70ffe7d6

                                                        SHA256

                                                        d9c8ada6ee36c08361cce88e0105b5d0623095aeb1083e5b4b676c3b701cf8ea

                                                        SHA512

                                                        01e9a08c3dfb506775ee6685b756633c1a6b81bc0724e7401886e7fc064d23b49e2894eae46eb230e344f92b5a3fae5c87712a0c622f9c87f9f09004007541f3

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        43ab7dc019b7afcd018c80ac84b15c85

                                                        SHA1

                                                        8529a097e47c2aa43a21d5bad7b7fe85c55c9237

                                                        SHA256

                                                        889f17e34272693c156f943755accfb3accad9ed5f794e0e004e9587ea9cd96f

                                                        SHA512

                                                        5c7273f1968b030bb77be27ba7eca0eaa89d52754861fbf3aa3bf14c1ce9e22e64db336b0d6632f13412d11662b4f50f15e58b4edec58620df20c9c4a0092270

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                        Filesize

                                                        8KB

                                                        MD5

                                                        42dcac479837852adafc98346143eb41

                                                        SHA1

                                                        af570050b0f23806d6f59578b8fccadd262b3b73

                                                        SHA256

                                                        a36e64c9556bb4bdb5113eca7a656a1e9087575e04d16deebf180538ad3a5410

                                                        SHA512

                                                        dae5ea641f32582563e9e2a084dab2331a0680b91dbeebb86eed39d11852b76414606fb1ac31cf3c5ccd2e3e533b96be360801554f3561b39d807102d4f87f46

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        12d03c3f7ed633ac047f8ef3126efbf9

                                                        SHA1

                                                        c22378e655e466d34381366a4468918c3c498bbb

                                                        SHA256

                                                        6ab17d17bfecfa7c7f1b5b3d8d8ee6850d3250410f1ab9dfaab14f54f1431cfb

                                                        SHA512

                                                        55a8b479c7329cf0c940cfda18b27af8298aff5e6de1bacf36b4a3bea9654dd30ee1988100f7b9773a8b47cd22e7aa3267fd09582b73d394c7bc6382184cad42

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        81aff53ef96eb78486274e97f0318a80

                                                        SHA1

                                                        76c5b45053d7c81de08595e6e783e42a77fa2740

                                                        SHA256

                                                        fbd27ae93594efa00f77504c751ec2f600d6b1c0dfb63f313769ac4f9aae35f2

                                                        SHA512

                                                        78ad31d772673811de69403a0e80249911765cff9af6f98870e94e77432c09be6f0b593e730a09e3e3b76a936f33f2d02df062fe6e037d07157891aa2b9fdf46

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586a4e.TMP

                                                        Filesize

                                                        870B

                                                        MD5

                                                        f4163d87cd2602a9a6a804a25110d03e

                                                        SHA1

                                                        21da631a361f66c60a9ed43c665b512e85fcba6e

                                                        SHA256

                                                        818212588092434e6ae2c7fa5f80845e54858a4a9ae63149af4593d9cec46e9b

                                                        SHA512

                                                        343d6271014ea23a9753c6620e9f628ae184a87dfa72566fa1ad5ed55cccc9bd5ae7ad7c1593f79b2bdbd73d1be436b1521ba270a11a5c1cbbb2bc22d585b1f4

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        46295cac801e5d4857d09837238a6394

                                                        SHA1

                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                        SHA256

                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                        SHA512

                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        206702161f94c5cd39fadd03f4014d98

                                                        SHA1

                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                        SHA256

                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                        SHA512

                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        c4ef271ea035dfc93be218ef382c39f3

                                                        SHA1

                                                        02658b390d02a0cc98252dceb619d748858aef96

                                                        SHA256

                                                        c068a3efd7b911212561fe0cf2a6b49f575bd8f4acf1ae4c7c2f9024f31081ec

                                                        SHA512

                                                        aac471fe538cef884792224e529a3fdd9e981ea1e65f91f1a89f6573df8e6ad833034e44621344475570c3d1289086c36b3fbc185bcc4aa9f4852db90cd44989

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        11KB

                                                        MD5

                                                        22a5cb579693bf43c1cfcec0baf61b3e

                                                        SHA1

                                                        5ee830a50e4fcd604de8b5279080d9d12480c5d4

                                                        SHA256

                                                        6e3f6de9a89844ab757c1f61e65c362f1fd9a6cf38ea7a7252c1e8ef791e5243

                                                        SHA512

                                                        bfe44a0de9771fde6dba551dfc7fd28037f43a18055377a09e791aa457de665badde9e8003e1bca798a2c2aabdd5028f364803b43139493ff5179f39553589b9

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                        Filesize

                                                        10KB

                                                        MD5

                                                        ffba2b3911192ae0ce2c1527cd95986e

                                                        SHA1

                                                        e5350ec5fef15fc2e922fe5f58481876aadd218a

                                                        SHA256

                                                        d249532c7a83536573813d9a82d1388e558c8344ec1fc464e39b7e4182199c8f

                                                        SHA512

                                                        8728183e7a3113b0f27aace1db540fb2845c7ad6d0902529c845ff001be09fd388a1a7482fb67e61ef0eaa655da7e8cbb871773e8e0f18749909e706d8551737

                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                        Filesize

                                                        2B

                                                        MD5

                                                        f3b25701fe362ec84616a93a45ce9998

                                                        SHA1

                                                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                        SHA256

                                                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                        SHA512

                                                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84