hxxps://sites[.]google[.]com/view/oversmart/new

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/01/2025, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sites.google.com/view/oversmart/new

Score

10^/10

google discovery phishing

Malware Config

Signatures

Detected google phishing page
phishing google

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
41	drive.google.com
42	drive.google.com
6	sites.google.com
9	sites.google.com

Detected potential entity reuse from brand GOOGLE.
phishing google
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
4032	msedge.exe
4032	msedge.exe
1396	identity_helper.exe
1396	identity_helper.exe
5968	msedge.exe
5968	msedge.exe
5968	msedge.exe
5968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5276	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5276	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 3240	4032	msedge.exe	85
PID 4032 wrote to memory of 3240	4032	msedge.exe	85
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 2584	4032	msedge.exe	87
PID 4032 wrote to memory of 1080	4032	msedge.exe	88
PID 4032 wrote to memory of 1080	4032	msedge.exe	88
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89
PID 4032 wrote to memory of 2040	4032	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://sites.google.com/view/oversmart/new
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa94646f8,0x7ffaa9464708,0x7ffaa9464718
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5524 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,5480725249155297698,14715262319001061272,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3488

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
17KB

MD5
a75c0771ad920b3126e8c7fa5259c627

SHA1
066aac8689e0c8d6885b58272671c189e56c2542

SHA256
a92973e47e5b9ce381fcb05f91a8ce8c3e331c7ec766dc58602f4958c9a34f60

SHA512
9f371cd9538ecf948cc1b414ea66a38a9771ea4382b4824ea840c22303220514e8e0201cbf2ff2b863423d79795ff9720c156e3106044616c4c54ce21e7192c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
546947f4aeda14459ea20fd3336374e7

SHA1
419b25b984963ea1ad7a5848b1770a5b419488ff

SHA256
d01a0c594265cd3d8201a44071af5d88825f96e54b9af3734cb29444104617f4

SHA512
80edb8098bf226160b1770718167e96e9cee3ca2675f5c070e2a9b1e063a090fbab383b7086c5eafccd4e8dcabec71823f79b391e19ab1a663b9e398d3f126ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
91238477907f410b6045351e396097b7

SHA1
a501a2f2d9ceef4c7bc2c90f38b2d5e98ee2368b

SHA256
2ee61443724e852ac935a9d15d520da1852fc0321a24f41f497d85c80d91b386

SHA512
03297b13000528534d7fd0f463f991c13389679f8fd23a925955e695fb9f3290d9e7aa05919f0f11bbbc7b771963303a4221b3f7716fb044eba1a7b57817a6e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6c73d987c26926bb240bcea2eb53a30e

SHA1
e6656cf4bc8f8b8c6b45cd38962a54a7270d6f02

SHA256
d5752fddc455f274fcf7f482c751813addab8ee75fe452e84564d1f2eb9be1d1

SHA512
e4e84f45c4e8a91e124b033e414c4e6728bbcc0dcba0b3e9ca74c99d5497da20d8554ed8aba436f66aac9f5ced42d3311f208ffbeeb5043227b61c99d46094c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4a766cdd10e06b89609b0145f68595b1

SHA1
ab11e696bc8c1e80a89dd7c3316da4af0cda27e1

SHA256
846481c3112fce400b462713c9c92dab977f3c2c083ffcf804de4569bb164f55

SHA512
042f13a46402e52e476635bc3ed38993054615ffac4e7f65a7dd35a13f04af4fabca165794d8605ebced4f4e10200934e7da3c349e099f519d38ac529dc9cd20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e680ef7534847b5a1d0acba2efe7d4b6

SHA1
caff98ce8b2a79218b12e50ca43be78b930e0d6a

SHA256
0f4b59c72b3fa38f3f1eaac581ad616de10d035fa4f3598a6c4045ee60c731d8

SHA512
6e50833165f4b745145e1c72f8d9f4c1979e5d2e5b28a908b39123cb2fa2a84c016e2b456e0111bb002436121d18c03a849b71573c25f1294cf37cf4e95f690d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7ecae5b7533790c0883944158f565e1b

SHA1
5a2705e0aa07fcd677f18820fadd9bbacade6130

SHA256
8b77faeae3c38ca224afd8aa43eab095ffa55820817c85d60a4d1d71dc8b50fa

SHA512
e2369936212ebf9ef450c70e47acffab8ca9b4af35bdfca6773add2e65f341867b76003d81a506977c14e6751dad8862b8ba278b7785531680ca0f288fcb776e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
74cc16da5dd409e0a00975c8de9fa00f

SHA1
15db536fa55c84f729d08031d4ee12b7dc7c6219

SHA256
b4699c55852488b59b7ddd25c2eedcc44713f2dd01ef295ffd72f5412040472c

SHA512
d48324924ae7d73385214c1811d2e196caad8d0007ba674581946d6d3b18d96a1b128b8232679fdb3a7ca8cf26436b65f0a1d775d0058640902a56447a8ee838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6af3d290ab49710c9f4e13b5176e6c4e

SHA1
a9844b7851708263f74a17a223fd9ddf16eb23a7

SHA256
7b1d320f2a79b2cf1061ee9309e30f2992727e9f8654581ed0da3f223e860fc5

SHA512
a54db4cbc8512ab567d0d56d167ca6cc029d084e2c136a162b411a9302ef7c3f67a2f77b12012274b98a0c798958673d9a745e8114739846bb55aaaf079ef2a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
870b7239a4f457f487ec5ba3cbb2ac9d

SHA1
9030f0b893518e5703c9bef9d681af0f951bd84b

SHA256
55f1ddcb9d946e91a83eaf2f2c182abf8d7dc72cf29ba62d85393c490ad36ce4

SHA512
0f3bb3e758da306f8731c4a537a96d70c240c83445648a7335b9aa6c998c297902e351ce081de419f094bf4af5d404f967464165bca4e16562ff2ca6fe664107

Download Submit