hxxps://danaherlifesciences[.]ent[.]box[.]com/s/xerhwbglb08d8gcd2baycdoud5aplbvo

Resubmissions

19/09/2023, 11:01

230919-m4llmaaf52 1

19/09/2023, 10:25

230919-mf4sasae38 1

19/09/2023, 10:22

230919-md8ngaae34 1

19/09/2023, 09:24

230919-ldjhxagb4t 1

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://danaherlifesciences.ent.box.com/s/xerhwbglb08d8gcd2baycdoud5aplbvo

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3688	msedge.exe
3688	msedge.exe
788	identity_helper.exe
788	identity_helper.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3832	3688	msedge.exe	39
PID 3688 wrote to memory of 3832	3688	msedge.exe	39
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 4516	3688	msedge.exe	86
PID 3688 wrote to memory of 3088	3688	msedge.exe	85
PID 3688 wrote to memory of 3088	3688	msedge.exe	85
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87
PID 3688 wrote to memory of 4300	3688	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://danaherlifesciences.ent.box.com/s/xerhwbglb08d8gcd2baycdoud5aplbvo
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd21e846f8,0x7ffd21e84708,0x7ffd21e84718
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2204 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,13299942037097086263,130818743678185064,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
3c5482e3da23d49b6c3024828144d622

SHA1
c11ddabfef7ff41a99e3b9342f8cda0e96db91c6

SHA256
47c7d047670fe04488f116b03f4fb2cffe71cdbbe6663d0db448be419ed969ac

SHA512
daffc6e5b9b86eabfb6434fa69103c2907896b23ba7b77a3d2fb146f898834d48d8ceb5d6352d444f309c19541824f3cd6eb33fa1c505c7a6ff6f9c1031cb604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b5348789b287383bf151685fff362764

SHA1
a91bafad17400e266872e7041904f1464d6e0022

SHA256
97b91d5a29e3fd3577ebcf816ef07a938ed426232dfb530ef84d51a69b6fe415

SHA512
304dff51d12ccc71025f0258517b5ff390d04ad8e00c9cf1c46f7dd6264baecdd95c588085e321b4cf11c2ef6b8ed4b4c210cee3e567e79d3b7d4551238842c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
989B

MD5
cbfdf0d08a4192211ad45f3dc7ea8905

SHA1
89bd038b63dc05337a7d85ea9dd323408a0a7cab

SHA256
85e2ae52084bdcdc5397eed31a75af56fb4eba134fe54b6cae26349a2791c333

SHA512
97a0b9d3b3e1dde1eae86bce4e29519a49e4d89103bd005e9ecd7cdfd8e767b8391fa5f14dbe1be6b5d6f91d19e8bb5eebd367b64ca9b8c225ba7c1b58fc7696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2543fead23486fbff7c53891f5f0080

SHA1
a8f6543e321bff547d3cb08f68184f9808895487

SHA256
9482787cad9c321cf3af40516ab4f1b6292a0d05a946ad75c00aac7bcc7a9664

SHA512
3eb5e0d2ba40f50121743be855229e3145fc8c2e4ba35720dae011405f747db5567bab1f59ddb045e949c70f9bcc4c497567d831730af7d61b98276cd428cfd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a1717e3cc7bb9c9c6283c02adcd6b5c

SHA1
fe2e6e955f0c3273bc563c8ef1268fb6f2271d5a

SHA256
c7a55a872ac5cdcfd0c745188c65202fc72513dd0b138d7777da4428e76d407b

SHA512
4396d9a7c9a6b521cc290dd2378a7f8c18dc91597d6e68a0f52ea33bb16a3e81fef1e2939c5d6861ff6198adf99eac97e57fe8489007b570697bf344559ff986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e5dadcfe96265831ff4bc39fe6be902

SHA1
392ae372151f9685dc08dc5474785ab0f4cf9172

SHA256
1562adc9af18e7ae2099b6d2ac1419581041b9eeeac9aa6888ec8df7e640233a

SHA512
03b540bf4d18d830c0e88ad93cc3d24b2bc35fa76a49a21c8994c82f5201598fa608f4c15cf103027bd7a26dbcf1883cfca9576f512831d7346aeeaa3be28efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
15ad31a14e9a92d2937174141e80c28d

SHA1
b09e8d44c07123754008ba2f9ff4b8d4e332d4e5

SHA256
bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde

SHA512
ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
708B

MD5
f3154cf5ff23aec48fc773ea6f98f888

SHA1
a60c707af5a1521c4d78d9007aa94cd23e605bdb

SHA256
4e1d9037092a9850782ff4a0674e98e428580ada23dc559031a5e4bdcbb42687

SHA512
304964b6c2512c57fc878b8dda5a66363395ae45d00be9960e4055654aef46b43527462ab5fc517a4f154dda0fca6069da2d9ae42b7ed99cd0169090b96f2c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
876B

MD5
4682606e3c40d21ff528ba73094c7ffd

SHA1
e3f187ab7ddce8f68d49e64d154feca3400ec4a9

SHA256
744899bf6610a58140be22f26a3b01b0d0f4dca1dd78e2b7ed8e9463c6d70165

SHA512
7fd79b914a01ef31ccb8435d15f8d4e75ef304f35659f99a9411d27950e5306bb915bdb343a40b8386e4e14e072717becb29e0480e52c91278c7d6e7d784337f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
876B

MD5
79e14872ff1869b65d4bd9cece8882d7

SHA1
0b0f0f2df4f367bb7761a3828c152b729afb360a

SHA256
dd4033812fabe367e8a716e6a3264d2614fd65a398c20c8fb8a3628391e3a2f7

SHA512
fcf4159e523aa3a83fb9f47b61acf5f5347d5dc6e8458f72e9ea8c55305a233caccd10d83040c3d1c1975d0bc91fccf82c1cd9abab54affbbb77c442867c7d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57db9b.TMP

Filesize
708B

MD5
92a000ba2c4ced5566caefd3d3d7f1fe

SHA1
32718d89227f0c29aa1df16aeb29bba18522606b

SHA256
6835963ec682e9703442e0379b82b2d19191b997bc5c56604332d81d8c03f9fd

SHA512
c2bf0d2960d92f5e386d64bdba1d258e55af216bb313da88d09e479b6956ef0222d81871417bd3975e1d29ba5b3918bf00341905cc7f5ef2933e73cd240bf846

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c73bba02f2004b1acb9a6ff55c6f359

SHA1
bd6af4e2832531c7dbd56b12330ec13d4f5f4e5b

SHA256
650a63b6dc9eb1a481bb0baff57abf973dc44ea1f58cdafa100aef7159780447

SHA512
c601449a5dca9b6e84925622100c8f9c3e35bf465239e6b9f9cfe98b8d12ab38a97fdb118a910a2d4643cd07a03a46502b0c07acefb1947af6e8309e656db1f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d7d92d05a32ff88140dff669bc0a81d5

SHA1
50226f0e77d4efe2915a23ce82d7c8356e9db957

SHA256
26ccf635f83b4a9c16078c6c631b3643c35a3e8e12f6d48f7927b93b0bcd8321

SHA512
84314922fe807d051c83f1ab16b102662ef1abeb0016926b678ce493310a11dfeb6abbd2f7d0c86c3d00475ddb52aee876a51084c8d6d421754b5d08bd8ab9fc

Download Submit