hxxps://saphre-tuscjanic[.]box[.]com/s/icbyjkvvo2tg9ky5mrgom9z0oq5ob83k

Resubmissions

05/10/2023, 20:15

231005-y1kqpshb69 1

05/10/2023, 20:07

231005-yv1vqsfa8x 1

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://saphre-tuscjanic.box.com/s/icbyjkvvo2tg9ky5mrgom9z0oq5ob83k

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
3796	msedge.exe
3796	msedge.exe
1172	identity_helper.exe
1172	identity_helper.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 2608	3796	msedge.exe	35
PID 3796 wrote to memory of 2608	3796	msedge.exe	35
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 3636	3796	msedge.exe	86
PID 3796 wrote to memory of 2836	3796	msedge.exe	87
PID 3796 wrote to memory of 2836	3796	msedge.exe	87
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88
PID 3796 wrote to memory of 908	3796	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://saphre-tuscjanic.box.com/s/icbyjkvvo2tg9ky5mrgom9z0oq5ob83k
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe544446f8,0x7ffe54444708,0x7ffe54444718
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,191213022748980275,9686785429243519185,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
2c6da3648eddcf9c565c6afb200f5ed5

SHA1
604a38eaa1574c9e0a175288715f619d12aae1a2

SHA256
f89cde58619a176ff04609b1d0e49398d4283568e5364a21bab858666d1b2a01

SHA512
e200f0edfb27951672545141ffff1ef1087c5e36c90b50a15fc248239ea126a2eb9f98f6ad6a21813b064ffd49d2eb9458881ee013d47f162bac985c79a338cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e062c5b5dea435629f2eb4cc2cbd0086

SHA1
722b4fe5eb16c3437fac8332b15a615e8ec1acbd

SHA256
064494fa54bef8c765153fafc98e9a1334f7014bd824e7767a35885cbb58e34a

SHA512
713940be9c005b5bda14805e2a639c2df16578d819b49936a5ed63cd66e3871f1d1a95a6a928a6b01f4332b67dbefde48c078a3357025bbef0df9860101d46f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cad57bdda39da64b94deb684c4b8167c

SHA1
39fae60371ad59fbdb15cf49beae60ffa765b60d

SHA256
cb118efa2019ed6497a5c1102053f99d65cd29ec2a05a1121c589f53236d602a

SHA512
5d28c5f9d85b7565a3b13abc01bf38d47367c997fc7d78da1786186de2ac3f856df453e146d3366298b0b7bd10f42624b10e24842d40661d7ae032dc136d8fe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dab566b256ec83f9786737cc5d58a9e6

SHA1
186df2c1e11f49851888566b7c827d922f61cae0

SHA256
d260bb97137c665434003b1f329a8c4f8133e08dc6d178c8d24302d92c99b6ff

SHA512
b5275e4c740a2d3bac9d71c36e3566ee345e2311a27bfdba7c29e974c1ef98edf3c3c867fec265ea9535f2573194e1ad3fe16991d7b2cd883423b1d9ce59b2fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6df4888d410525430e52c1e7fd93126e

SHA1
a76b06076e24f276ec30e9aa6cc6908b7a599ab6

SHA256
6cd5bdbee6a9afe796f789e7956db1f01d6c13930ae968220ed24c91060f1da1

SHA512
d3716e7faa251c1fee9508e1606b67a6d62574e13d0809e4903c769124364617ae4f9238ed005685586b577f0c03b408c971c8563f9acfcc51553955126816fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9db4811dcb8e1d3bf1257310de854ce9

SHA1
6c2d34980673cebbcf22c26f8cb832092e08cdaa

SHA256
80cf2f1b5a3f4281c3158f4b970b4c2c9f10de91d40bac456edc52f28d8a9eae

SHA512
2c71217679203b9f23ee8c1a41aec210fe135ca8e50ae12fc82e84a7a8ac5823bd12f2a1c1bdf60cdbf6dc3e64de4f6b5bbc7d44397fd5aa6d767ee1ab293ff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
699e3636ed7444d9b47772e4446ccfc1

SHA1
db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

SHA256
9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

SHA512
d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d2a0748342b677c59d66a4366008029f

SHA1
afe1be6e867401b29fad66c6f4570430af3b5f64

SHA256
712701a3c95dafa40c08b97089c0d658a201025380325e146ff0b545db9c64cc

SHA512
233cc4c4e517f0f52e571d131e67b1cf935a6f2b6bbd24391ac9b0ffd1c405a576740c11eede72d3f3bbbb37cbba7132cf533621e17e0720b3f8b59b0811ec19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
94638d7282306fc007768813b35d3bb7

SHA1
f48a515791fe44d973b883a2ab287f58b318689d

SHA256
c09e2f404fd3e2089b168a554b749eace8b61b13daf67d97be94dc9c861ecb21

SHA512
43734a22587e23afb7a7613be48c749c81b479bb89117f3d5d27f3b3c889788b77dbddb94ce2111556a5843c583e11cc0282a7627e12912be48b67c508f553e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57be10.TMP

Filesize
1KB

MD5
5fff5cae47dc0cd44186ccb47c8a9e7c

SHA1
1dc521c11300f35906988b707209b1b1e0523435

SHA256
5d54e4cd3804c3101d1bb641ed7071eacbcd9c1071610a6c7f343f964d3a5678

SHA512
420f90a931fa72bfc97d5274bcbd476a98d356bbc9c93f499afeafac76bb72e2b6fa60efbff4ada086d1479f8113f915abbae1f702d77baab5b077aad776a95c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
373c4ca313434439bb51afa23f6893cb

SHA1
986d710f18338e5727cffc2861523473c15557bb

SHA256
b274f20d8d4e36fb09a21b92c16433e38ed5f8eed1c56488b8b32ac57a1b3712

SHA512
5ec7b1b08afa36d0ac31b4ac7f1ebd9a02effa07fed531e73409e3a1daa7233f839e29501e38b3a5042c26691b23bef0b9f5057026d48b3231ebf387250096cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f63ee3294c9b1b58cf5341ac5e4cb2b0

SHA1
8f16683932189137a7b8bd38f0c9cb1e0e173348

SHA256
6864082b76b21bd3f00a6550d0ba045bb5bd2afb7b7e1e033140e16cdc640019

SHA512
e5bc707cd79051528472e9731363ceab8dc27f99dd492326212b576421ca3315c454261040c8fe27df34bf0378ed707b5382ba06eb9933b3a997d46a0bb63d7e

Download Submit