hxxps://docs[.]google[.]com/presentation/d/e/2PACX-1vQ_2SU-K3VHDyQZQrsuF5w-vsb7tg8B5x6CFSzjfxSy7vxBB7GOElHRtU19TRpgmx5k2BC-gFKUfAvz/pub?start=false&loop=false&delayms=3000

Analysis

max time kernel
140s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/presentation/d/e/2PACX-1vQ_2SU-K3VHDyQZQrsuF5w-vsb7tg8B5x6CFSzjfxSy7vxBB7GOElHRtU19TRpgmx5k2BC-gFKUfAvz/pub?start=false&loop=false&delayms=3000

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

868 msedge.exe
868 msedge.exe
4488 msedge.exe
4488 msedge.exe
888 identity_helper.exe
888 identity_helper.exe
5196 msedge.exe
5196 msedge.exe
5196 msedge.exe
5196 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

4488 msedge.exe
4488 msedge.exe
4488 msedge.exe
4488 msedge.exe
4488 msedge.exe
4488 msedge.exe
4488 msedge.exe
4488 msedge.exe
4488 msedge.exe

pid	process
868	msedge.exe
868	msedge.exe
4488	msedge.exe
4488	msedge.exe
888	identity_helper.exe
888	identity_helper.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

msedge.exe

pid	process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

msedge.exe

pid	process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4488 wrote to memory of 1800	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 1800	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 3900	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 868	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 868	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe
PID 4488 wrote to memory of 2032	4488	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.google.com/presentation/d/e/2PACX-1vQ_2SU-K3VHDyQZQrsuF5w-vsb7tg8B5x6CFSzjfxSy7vxBB7GOElHRtU19TRpgmx5k2BC-gFKUfAvz/pub?start=false&loop=false&delayms=3000
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba3b46f8,0x7ffeba3b4708,0x7ffeba3b4718
2⤵
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
2⤵
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
2⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
2⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
2⤵
PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
2⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
2⤵
PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
2⤵
PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
2⤵
PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5996 /prefetch:8
2⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1820 /prefetch:8
2⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6588 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,15695422713298228086,1798495264285559627,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5228 /prefetch:8
2⤵
PID:1984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
336B

MD5
5c87a0f76af964b631b1c8bb22343abe

SHA1
0b1110d2e3da6fb4771ad261f4a4e595bbd3c427

SHA256
50c51626706e8ba3b83a53fe918d2fd7ec4bc6f461f6e2cde0768ef722cc3f9f

SHA512
69ce34a44ce061a059daef3b94b6c162b0933ec330e6c1e2e7b4845a0d9c117329a8bd375e3f7727a6ad64bc319de904f315462434049f68dce1e163c7196d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
192B

MD5
95d579e6072c90d1ec9c58bf6fed071d

SHA1
b7b9bbd4e1cbdaf8e99232d53a9edfa51afb53e0

SHA256
e2df819d8323c319ddb761b5a17794b2ee32385d5ed31b6428ef8281a5251936

SHA512
e36bd9b66c6e9c8c8632c5598e8f6a2e264dd2d8db1f5744381baf5c3db0df45a1087fd8a2aa4206fc63598d1bd32dae2a26c9fd7041e6890dbf5e7b5911a295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
66e48aa9d38d5c07c449e9051f056cfd

SHA1
7a3acfff094117953844bed2576f3009ea6167a3

SHA256
7992f32385e82746f6ef1bd58d9cc8718442af850cde13f463bc714f37c60ccf

SHA512
46f79b591b4cf40e528480a186c8e43be2a3a74ec1cd18aede81b577cd7d66acfdf6fe71602f56fddb80ba0bfaf2148579d9078d032894fe98fde89ed0a32d41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
559c16d6fd6f993e6af7ba8aec615d25

SHA1
cc294cba0767a2ffe3360ce52dd8eb67b0311132

SHA256
d48c16c562b725ebcabd87a6e6ee9de579fb205c027bb1eabc99601f6a617d85

SHA512
4ff1a832b44fb1122538754b1228694b2e4ce8cf3742c417f1445062b6bd6c4cb3ef0789a57fa699b049f55f6d44a91204bfc2b23232a1756228bff793fffa37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
9c2851a42cb05d64d36d7f65a6517015

SHA1
e4122e3a5086d7228cf3da3e73fc9cb22110f959

SHA256
c9204ff424c55b5fbbaeb5ae42ac18a825130648947409b1e29e1395aa53ab03

SHA512
ae1ef8f68b535939d437c45c22cafb00150f22de3abecd70c0239e0ffd80b3cf1a0035bb73a787c93d489dbfc97f8b09dc91564f6d4fc022f84f7bee283d3c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6a10889b75a5047bfbe07758fe01bd26

SHA1
e8956830938b254269d5df1e91882404187e787d

SHA256
b4058f5fc04f098fb344a0cfcea73ce2fd4209d743540cc50c15c28085cc9853

SHA512
75beb976e4603fed410ffbd994bbfd606d5aff5de09e30f31892685cc6bcde28af4dc86eaa10f0412bd2305edef2e59a34484a3746221ffb9f63f88e9d3d4f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b4f8139a511a9ddf280ccb11669d153d

SHA1
b449fd89c5939ec20333ef22c33f436e2211ff23

SHA256
5e057e0ff532e1c33cfd7ccf3aabc21de1ff415e03c1309c1b4304ceeb2914a4

SHA512
b0b67e671d53dbce1eae731cb0e95c9044b060e736b838761678570d76306935a5a59347cf4da042ab10d82a8e0de66e7c662992c32cef10d9e3b76b4ae43c9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
874B

MD5
9fd5f2e97115c4fbc130063d0e006b6a

SHA1
4689912162d987d2f2a995f5abd9d28ca550342f

SHA256
c941997ee27c244151a0a77e4f7b9352e932e79e0821dd5f13c4bf48a7de31fc

SHA512
8e4ccef72393117436c9e8990934dfc7b49469bc0e0a4a471423ef27f6f2fc4bbd90772abafc6de0f2768e95bb6ae350acfac8171743f94b7533fc4c46ec005a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ef71.TMP
Filesize
371B

MD5
ff067bfa46c2978a7d234573a00b8bf0

SHA1
1fb89ab4b0718421cf4e838a9fc61bca55b7f76d

SHA256
752dfe949f5bed20e84724cd08fa8f0c5296b030dd6842e98e82b688cfef936c

SHA512
1cff2bf66fb8669913095c539c0d45551cfc2de506b8bc6c0694112d40f13d0914a190667bcf951070b52e93bf91d60566011c31c04070647f9aa7c4fffe9a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
f985ba19205f62d57d3dd2e35d38465a

SHA1
ee2bdd40862f5a1a3d82246c661077566ad3e99e

SHA256
4772203c8fb799ddef36fee82f45ee67de87f1ca3f5b67d382ec55b75d9ce9df

SHA512
5f3f8f0f2949dd1f91a7e1629254343d68919f062134fedc49ad266a42e9ada52a0400f7bc1174217bf94cbdc47041842803e0dbab6e561a233699bf83d6efff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
0672e5ff44dc29ddc9bcf1b4373a5273

SHA1
0890de54b7a9b276fae6f0de7a61bf11e8217fb3

SHA256
8f6c16b29009f6bc02ae26ddd6a4566b849d9f91b3f5ae220fa7bf5067be979e

SHA512
6e155b9a1f0b5659957831e8d835c417a973551d01195a8839559df4a58df8b0662c5ae46500dbdbc5062b9183b45fbcdf3dca2873469ac5e6a15f6c97979b71

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\LOCAL\crashpad_4488_WZQPRMNOUZAGXKGE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit