hxxp://xbox[.]com

Analysis

max time kernel
1881s
max time network
1886s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://xbox.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
860	msedge.exe
860	msedge.exe
4116	identity_helper.exe
4116	identity_helper.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe
5720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2876	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2876	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2152	860	msedge.exe	65
PID 860 wrote to memory of 2152	860	msedge.exe	65
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 4036	860	msedge.exe	88
PID 860 wrote to memory of 664	860	msedge.exe	87
PID 860 wrote to memory of 664	860	msedge.exe	87
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89
PID 860 wrote to memory of 4632	860	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://xbox.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb404f46f8,0x7ffb404f4708,0x7ffb404f4718
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,2193184780527891147,6393665856010495711,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5504 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x518
1⤵
PID:2312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
1024KB

MD5
cadd73d33b7bf583c8ad0502f4481c34

SHA1
448437b657456c46971072aab57d8ef4ecbc908a

SHA256
91b4c511ae287bc1177df9eb5adf8f5b2422b541c1dd35b655c85e8641dcf9a3

SHA512
3625425d6600c21189540279192d4848bec0eaab7de9769fd2be542100d5277b5edba30b6d84e278ef9fd1c971bc2c0aefba2ad28881a511b6d53d15611837f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d3945db09623d7da3a4a3642c57ed4e6

SHA1
4a244a03357d6cca67e0b65b6b1b044f4f9243ef

SHA256
69f4c9b76bffe5504b7ec2da987c2e20a9a696f1e1f023cdbe5d30abcbcb7949

SHA512
01077b54ca9bdbcf32bb9af3f8dfcf4829023ff128c076b81d4d28e24ecb18c456f5ee3f553e981784c7942b0c446c00021f2643d0fd98848d195e9556fffcdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2a6902220060f787f4172f9a83a350bc

SHA1
0d44cc576967a8437fb7f4b8e6c8c83843db998f

SHA256
33fb1a3a986b87822faa947e5ccac29f7623ecd38d000e5bfecd67c5fa32ee1b

SHA512
ed19171b26898d5f3a9e3ccb968f547ebfd9e33b413701b5fc34ea8c6a6628484b341ef55ab3bf687525458c2847920ad2619814ecd6633e984f070351ed3eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee35c6c519f8727cafaccc4ecda84578

SHA1
90b72a0712bcd41b0b3a99c4322d7e683e127b22

SHA256
7da7262fdb0794f990fb3d13df8f84a0c4518505f51596a85f4951afb9469d51

SHA512
e8bbedbedde3adb8b8ebba6aea8e61dbdaaa5ed71a7b89ad6ff4c8cee81503c5cb4f55e5047247576d28df80a686385a5b724ae68fd25e9542a995b694e6e5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dcb7c6ce55dcf2c86c9f6f6c4bff443f

SHA1
901e74661079d6063e74c59f56468d269c52d77b

SHA256
84424a4fa9f9e36689681537484ed7880d6dfa5b551efacb1a6a32a2e0648ca8

SHA512
25fce7f0ec2ff8e73bb6cb8573bbb87e0c6611b1f3581e6bf388708f4494bfab0043c75c8ccd6d6656bc82d03e2ab4ee34883f7436f74d15ffda5c47c562e7f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f79fd3e2b91f8fd228f39c2010f73f4f

SHA1
bfd8fa8f2ec054f285caf007905d9823b37a46fd

SHA256
71486cfcb47cd146cde1306044c62dbe98f326d4a8fdfae846ba82ac6ac1e27e

SHA512
829df18a53bf6c22ba0e4c4ff4c26b869a00e6c82244fb39eb84c160b5e90ea52fcb9f2a3f2782c496f747369f3d8b2ac355e3f6c075cd7162b8486865cfc7cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d758bb7a97faeefcb3e5b9fa5f0e0a8

SHA1
6a184e1bd3e82f5eb74736977d89a01db387ffa0

SHA256
9fdf0ef1dbb3d96379cd432313e2c6862559d64be75c3dc396e58ecbdb14437c

SHA512
60aabae07cb87b084ee957463e9d41c2b4b10652b087b1eb0d1e40fba43fa2ae5c24556bd862dec4d58994d29b2bbae2fafd82b85a24f44599e2f43ae497042f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efbef0743855e9edf0ee3329acdabe6e

SHA1
de3dc73cb41cde57f1f7eac10af0ce21da2dfd1a

SHA256
3912beda4386cff3ee8ca88b3e3395eb0dc9edeffc98f0345c3d6809a2cb4681

SHA512
3a8ce87cb8934cfa3545bda06795060bb9cb3d9972912d86d4e814bcfcf929a2fe0a9ae43507f25729d25a23c8c1e4edfd5edfb1aa5a82c6a46d189a92d954ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4a078fb8a7c67594a6c2aa724e2ac684

SHA1
92bc5b49985c8588c60f6f85c50a516fae0332f4

SHA256
c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

SHA512
188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9d555a9b2a844b1f76e145a54c722bae

SHA1
10e99eb0853d21e52d2524e8cbf6e146ccda67dd

SHA256
85abe176edfdcf2448687cda4bbec2bf1e53d3940df0ccba3284e080e0117e91

SHA512
ef6916995e96a19977d75bebec46954180957fba8f346c5cbfe398e86f8d53ee42db3fe6801521f09596b657c4fe3660d1e3be9cf5a1c6b02821b9055856b0b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2596354f0b4aeddfc2d1ba95383e1700

SHA1
58c515fe1ed0d19f0e0e67c634e2090b2de5cf89

SHA256
a6222737d106f4e356e5279f58ac2268b742134a49d2c6ac6d05d8561cc25627

SHA512
ca26991391d64edc15b27c7a77d967dd1d3d69f5bed9bd512d4f9b9467cebe108833bc1818de1d67904d851465bb2afeae83086ae41564baa955863311bc2c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580059.TMP

Filesize
1KB

MD5
f1dd9adf7792b300070fbe864cf45bbf

SHA1
6005defc2615f724437305e0f6c5219e60e940c6

SHA256
3746b905c89ba40364815e0ef36977b635c1e8066f847471862acc8f902446e3

SHA512
08703db7e445c5349f90932fd4ced240ef4f82f4bff5795c7c7b9bd36bca31aae6fb7a3139345f7789e89726bc26cfa181932d038e81516fd23746dbf3093a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6af2dfaccc67dd89c1a07026d86d6185

SHA1
b8710334df3054468f826129272411ca94852719

SHA256
a87061700752a437eabb24093ae8e07175446167964be2270c131fbd3883abe1

SHA512
d1fe0838d33baf0ea3d8fbbf14a977470428e959c8fb6cb0d3fe839b4b82c620e64b813f0c2de9872cce8548dac08fdf518bd7064af7553003c415a314f6362a

Download Submit