hxxps://drive[.]google[.]com/file/d/1kO28vbagVPJbDR3K-N5hEG6NjnFK4Wx1/view?usp=sharing

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 00:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1kO28vbagVPJbDR3K-N5hEG6NjnFK4Wx1/view?usp=sharing

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: favorite_heart_auction_off@4x-0965c7ae77c52aa0f128acbfa8fd41e10d1f2d72c2013f4a59d5f8427f663a55.png
phishing

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4552	msedge.exe
4552	msedge.exe
3340	identity_helper.exe
3340	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4284	4552	msedge.exe	83
PID 4552 wrote to memory of 4284	4552	msedge.exe	83
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4728	4552	msedge.exe	84
PID 4552 wrote to memory of 4260	4552	msedge.exe	85
PID 4552 wrote to memory of 4260	4552	msedge.exe	85
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86
PID 4552 wrote to memory of 3976	4552	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1kO28vbagVPJbDR3K-N5hEG6NjnFK4Wx1/view?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa333046f8,0x7ffa33304708,0x7ffa33304718
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1297048364500871635,12273796893156907404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
729a1264ad3ef31536f58c8b710b365f

SHA1
f836134a2e4b96373cbc7af06ca286c94c40f1c8

SHA256
7e5b12a9c91709ec0e2d4676e9c235b44b509c771d5f39c55f1ff2d92a27d268

SHA512
a1fdd5f2880b2ddba69c73b4c52de02277aae91095ab6ba224f794d0b747aa125374e0a0c6eed28c33daf1b3fdbfc0cf94a913d91c53b77e4ff2add6386ae164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b14a4a546459823698addf2d48660603

SHA1
6ff7d3ff9ccf1ddc8682c675a66bb26c63d7d3aa

SHA256
a4ba49641f7910e9058f434903081b1ed74fac8ee55dd4860e8d8fb686fa50a3

SHA512
d7925392e12df20b24b58163c44a9974a3cd29b5d6670dc63e1be0faf5fe6492ee90d76d7cd39e73353ddb0b1d7d9a73ea2d16f03c69b66966bfb3510e6702b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
9b064de783831ba57ad98e6940854103

SHA1
ba531101f168d00953a0fea7496992cf4fe264ca

SHA256
3c7dcab6b11cf6bf74efccb0652bbef06e59e9f3849a44027df15f33f3f619f3

SHA512
fdc4eb86aba07047ae124e5a217e8a55f7b277710ae6afebf61007c6464872ad6822373f5ad7a5abdc0e1ff69b088b57051e09a634999c0a2db10321d664b539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
4f6f25d979be323a1ad3ceb9fb548fe1

SHA1
7adc9ed82bd190b3a1e4b77f3ef75299f56d70b8

SHA256
8d294adcbb7b259f9056bd0163b20ebfe6e91d6765f3c0ffa78dcc84398c5059

SHA512
a45d586fe75da288ab856d3afc444b82ad975ac1e0b659d258673e8d36e3eb9bf1a01f1cc7fdc32633f3810750cee657eedd1b7c7117a87ae6175382c22be47b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
c5ec4314f66117e22c2897ebc5238ea2

SHA1
213ff196088c2ce0f3161f89cde0b467ba3810e9

SHA256
fe98dea64c73e4f4829e136857970314b7e695726830520fbe4054398b0c9ecc

SHA512
fd92c1e47d84832c0bc5ca1f1c634861ba5ae0f9b22fc40878d86321d675a6161c066c3a3dd95165ca24a19974a1546b9f9141ccc94cb3c0ce96a8d67aec771d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
00de71126054d96ee74f356192a46d18

SHA1
668c1032aedbf76b75292276e5ea6f06a95b384f

SHA256
39d3a578d2a5e1f83fbed713a27ca65a49881793a334dcd5c4dd99587427ba8f

SHA512
8043d475cc8e9f74c92e40eb2a3063b7e015965d2fb2bd1eb9309ffca0d98c35ee5b5a024a33ebea46b0ff2b1fe5e2970d6a929f103253d5388ac7b4a9f02f84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c357bf99ed8956d17f4ddeb1c6b04619

SHA1
3b331a921e7602dc0e885da97eca1fc70b811f43

SHA256
b34a639c4d0652c3f0af21122915a4dfd9a2db35473c30bb0da3a12abd844f09

SHA512
6a9fb5891dd04f390254bc722ab4f4c83870b808fc216a51a386efe7553efc1bd09009e46268dca69dfb247f3c6b7359bf2a53a6f0e42d42089f422088f88e39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
df53e85a00acefdc16f7ce5f580329f7

SHA1
07e4eda8db5e099bc66a9617f8f7695079333352

SHA256
85cc596c74605659365380bd43a595e0899568c16d878bf36f308be89a5f9810

SHA512
022d4885552285971e7335dd2a2b5b1a698ea488854175a0ef90eb8a106f8aaebd17fb0aa4154993a1dcb7df906abb32ead21fa4d2e73f6c8c888ca670845eae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a17655f0aa756c8278ccf912120d4bc9

SHA1
55b65994602f4ca458f0ab1c4ea8ea397ba0b6f2

SHA256
84adbcf41b4b7dc23fdd06ab03ac0e383802cca08932746f372882b127d54416

SHA512
51e4d91a14f026bd85f2ef0eb6092f110d5b83e07bbcd972357b2b366d3da100dcb436797ffc85f9212323a0e3853730b07ade290d730ea6504824f7458b713e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a16b.TMP

Filesize
1KB

MD5
e49415eb2bcc6a813185e8ddfb8f52db

SHA1
1cecab6f270f76abd1c872b165e1c6ef192d02ec

SHA256
f2ded4b34dcfd24d03508db47178df7cc103807f162e33a5a5893b9022235cc2

SHA512
f013ccfd50c6f1761279672014367b48edac0e04e66d61761d4442e12e8f276e2e92d0705b8a7c4bfdd553c9e8cff33c095fa153bc012b2e576f9e4addc02435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bf544cfc-8aa5-4e68-83ef-9909585407e9.tmp

Filesize
10KB

MD5
c5c69ecfc789db629a48f6eeb9f4f9dc

SHA1
9a9aa382fb42da139f82ec31240b6fd97dbb4268

SHA256
1bf244b055b6373cb61720aa5bea9217be44d2f010326c01c79c045053d27c24

SHA512
a878ae76aec7ee6ed8cdbe5ac5799c9a31720c3837820f85b89f87df8d05d1464d0a4f69a7bcafda77f1cec4e213d96bae5b0e50033906ad64bb7726e0ed1480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be0fc490ce944cbf58cc9f9a668606db

SHA1
6aceeda6c5ffb13448ff7efdf086a0f892d6938b

SHA256
3ae63bdb04ebd56f11afb55236e50a9a770deba4db443aa33a813686e7d76dae

SHA512
2eaa913f27cc14a19def78d9af39c8919bb66eb3471fcc9cfbc957f14a1571f0d3b1ddcb19e86e420836fb9574a8e5e0e517fec86fba153cdff5586d70426241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
98e5a5aabd523a55c3d9805bb65555ed

SHA1
9826dd8fb7fbb417e4bd5f3afc455425b1f1e7ea

SHA256
50717c44d071ac8ae47a4e1d1e81d16ba74b803f241cea0b8d7bdcfa4f7e4d02

SHA512
33b4798fd02dc278c4e29d38a3c754b9d65f3222d45658af19cb36227b70684eac995d0e30635637acfdde85109384c7b029e17a64dc22e38f0e1e332bebeb8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit