hxxp://drive[.]google[.]com/uc?export=download&id=1exrW4eArCFn4rWRiZm-_Z8vKtyu_rwNw

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://drive.google.com/uc?export=download&id=1exrW4eArCFn4rWRiZm-_Z8vKtyu_rwNw

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: FRRsultatsrgsergmail@gmail.comjzvf.IP181.215.176.83AppareilMozilla5.0WindowsNT10.0Win64x64AppleWebKit537.36KHTMLlikeGeckoChrome92.0.4515.131Safari537.36Edg92.0.902.67
phishing

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
16	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
91	api.ipify.org
92	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
5088	msedge.exe
5088	msedge.exe
4912	msedge.exe
4912	msedge.exe
1420	identity_helper.exe
1420	identity_helper.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4624	5088	msedge.exe	82
PID 5088 wrote to memory of 4624	5088	msedge.exe	82
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 380	5088	msedge.exe	83
PID 5088 wrote to memory of 3164	5088	msedge.exe	84
PID 5088 wrote to memory of 3164	5088	msedge.exe	84
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85
PID 5088 wrote to memory of 2640	5088	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://drive.google.com/uc?export=download&id=1exrW4eArCFn4rWRiZm-_Z8vKtyu_rwNw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0c6c46f8,0x7ffd0c6c4708,0x7ffd0c6c4718
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1015551734340968771,16204699531682236835,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4616 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f1b02ddd7fe3864cde15dd446e32d696

SHA1
8665a852bb9303f1d46f22825b41af6cd302a8e7

SHA256
92b131d70a0b98c4b092f0dfa484320f5ce063faab99169027ce98dced48ddbe

SHA512
1f8d0aa3cc07154faa204c22309246c413baa8aae1adb47f1d43393ff4bb9d7efaf9197867bb36fe3373541bd9083120aa6b17f619da2dea3601b96c12fa9c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6d712ff41adbb7f6aa8c5c2d5592c0f6

SHA1
e45b9b782da1ac880fd3f62d11bcb4227d195bb6

SHA256
a786f83bb5791b10aa969edcb096208c1916615b3e808b5d0d1af679d592e318

SHA512
d0047c6271b1ae5bea8d8aa54e014cfbf0c500f22433fd4378f18c753486f17719ff330ef6f00169a4f2c2dfb6e6721df94801ec24659bdda765551dad128253

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
55e4fff0c35269e434de9f095cfcbc74

SHA1
db6f96c955ad99a1a9fd43181b8b9a4d00a508f5

SHA256
2e5fda4f78a9eee269f6cd951773f5dce3bf8ff4853f247041949784c5f0864b

SHA512
cc609c7ae9a5274252452f34c73ee45dcf25149f4df596e7b0de20294ef4b03a8481498bdef5eba0271fe98eefdf80b23dafbcf872027aab9ee32b01f3a244b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ac8cd62d5c2297f32386465e7194d9a

SHA1
a0b625cf09f59ae6c98a204cb2561488792bc056

SHA256
91245b2177e7b2b58783cd66e25090aaa0916e5d2a1cc39990b0bc4d86240cb3

SHA512
c7e510e5115936de8734e70beb24d0553c6520115c82b1a6b68c4e05cddf9afad812f148bab1819506df21106eadbc8af6399200906c01b6b35a9ff6db6ea108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ced7e142f9883d60caac524d3823a645

SHA1
62f7a89a95e80366bee6ffd0bec81e5c29faf4f5

SHA256
ac7a4b00394223f93fb6f712a33a0af59441df95269f3c47c1e4989927d88c4a

SHA512
a97521d17b580bdf7515cd90196787ec1926ab6e188d9918fdc13f295af23cfb37c3d569a6908b94011205d0b4fd4a141e63ccaa3064eb8625cc05194b4fc0d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e2b9d868b7fbece9326400a22a01824

SHA1
d86fd43f30f68ccdac0b8a3a11b5432d5c3e1708

SHA256
822ebe48b2c9230acb56917f630a95902a11e33528690d7485cc850484d02574

SHA512
fb62bcf2add336b2ef2afdb7e26505cb5d72a5bfdbe7141e205682b30de306fe89f65648101d1e60efcb0cda8a8fa052be53a99dcd8c8b9cfd71448f6902efcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04b8bdc0b9348afb5d7874ca88dff207

SHA1
ee90dcdeeef15d40d2d23e36eb0ca6f6ae3087c1

SHA256
a2c713054bef12e928064c25823e2f10bc0f6ca92007f68903eb180ea7474fb0

SHA512
5138999e6c3ea19856d45dcfacb50aedc65818d87ac66ae62d6de9be29da411db0afd2d193859f2daeb63f9d7e25258888993c9c62f2198d03b73ac916bfe839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
12abd5a54796f2ec8a3f3ad2d5d11fd3

SHA1
8507f13feafc8f9cee55f848911214b970eeb1bd

SHA256
a0a3f5f01aa7a8e55e7f6c28d2ae609579041bd5d422919b99addd26bcdb4ac0

SHA512
d4ae03d263c80e465b5dd6757a5fcfba3987795ffd3c6deacbf729d7f0bac147da0e30df7c39d2bd35fd20bf2ce4e407d2d92ec257cf27ee3af5987ffbbae9d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e9a21d8444482d2ae5f8cae75e219ddf

SHA1
1de3cc150e4709ee2989dcd3a92b84047dd615a4

SHA256
4d08347f24f38fd459c7f78c7879cac4915b3bb58782020f0bd624743900beac

SHA512
1856b377f0dcc1af7dd05ac72a497eaa763bb20fa2cdd82f41d8f620205a5bd86a3124dc9b1ac40a45d4f4b19d9476b78032950de0eef67318c54527ceaa2182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
2294427de090d4efe4581a9c45e412b3

SHA1
d9390699643f8382be93d29d64dd15004046788a

SHA256
b8772a7812ed8188c667c812e739fa15ca43041e421d4cca9e3b0c05d5d11cb4

SHA512
b09136765ac3cc8d739378cbb8a8296df8b8f35c3d7924d8ed72e60cd14bdb454dc0759ade581fac3f86f16c997e5775082b93cc631ec57c6818766d1414cfe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581817.TMP

Filesize
371B

MD5
82a20f8e683620773d97559bc3e8b5d2

SHA1
9c6de20e3aa85994d739132cd17d384f747d284b

SHA256
ea4bce7fdd512dbdbe903a8802b96c19b162d956f24ae11c19ce5a0f440abba4

SHA512
0795f0c555b2a12a4a8591098600b6f35a590a03018c2d69f1cc9008bb387cf9519c049dac055b806487c6a626e4ce0ea60ec7f1bc57e1cfe1fd9b1e3823aa5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4c937488fdf5c9b205105f4823566973

SHA1
47f3f36bd544e94a0d0777c97e871a5acf4d357b

SHA256
9e91a0e713bcdc0c4e6828d41adf0db84d0112a86ec6a288e8b08f49cd13bb0b

SHA512
7334ad9969a1e3ffa7a5ec078dd703857a08663398d1960296d1821ff9833fac5ee80e734710cc082a3daca4724c265547dd1a460d50f3ddf93ab0fbadfe291b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit