hxxps://www[.]dropbox[.]com/scl/fi/ksc7vnkqn42ydfgn1e2mg/contact-form-to-email[.]zip?rlkey=gt9necwkxi97tp9soqzum8xh0&dl=0

Analysis

max time kernel
1775s
max time network
1780s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/scl/fi/ksc7vnkqn42ydfgn1e2mg/contact-form-to-email.zip?rlkey=gt9necwkxi97tp9soqzum8xh0&dl=0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1790404759-2178872477-2616469472-1000\{BF54D582-E39D-4F57-9D31-E57841754F82}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2980	msedge.exe
2980	msedge.exe
5032	msedge.exe
5032	msedge.exe
3300	identity_helper.exe
3300	identity_helper.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1868	2980	msedge.exe	45
PID 2980 wrote to memory of 1868	2980	msedge.exe	45
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 3104	2980	msedge.exe	86
PID 2980 wrote to memory of 2800	2980	msedge.exe	87
PID 2980 wrote to memory of 2800	2980	msedge.exe	87
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88
PID 2980 wrote to memory of 3172	2980	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/scl/fi/ksc7vnkqn42ydfgn1e2mg/contact-form-to-email.zip?rlkey=gt9necwkxi97tp9soqzum8xh0&dl=0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb621946f8,0x7ffb62194708,0x7ffb62194718
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12625421731838738027,10698821737284251443,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e221637-5431-4d90-9b7f-35494bc8f5b6.tmp

Filesize
11KB

MD5
da41d2c33eebd5234cecab5f6d5f3391

SHA1
911ea624a78380887fef76ea9be91d60d671d200

SHA256
8ec708a496c698f4e78ed3f7d8b193b67b8899f6b50979a5cc6bc26172ff3bee

SHA512
2b0608ea990c7ac8ab4b0ef6ef8916da2d4da071946d8b38c5d558b96726ab71581e75482c6f5b955d250120359add070bbd654bbc35ee36ea3ab0553d6e7248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
af83e921d498cf7846af736c84a348ca

SHA1
9d72283bd449a537cd2862008b52694123f80c1c

SHA256
08e4648be8156e506c3858294ca18e610a2e9a0374404e8dfc91933c5e8330dc

SHA512
23ca2184f7c594fef2825f355bc3e46d19645b6bba2bb56e4b0a7dda9aab52720b92b3fb84fc518d11f56d3076422311ee5e8e284c9465ece6a99afb22718a50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b9779501551654fb8b10fe1222d2c401

SHA1
75f57850ef93942071da62d8bb41b0024ad37ed1

SHA256
23131870948b399149f262bfa3f8338a603ca1af062cc5b5a4a6655a98bed481

SHA512
e3364bffdc024476365a15356cff5a8da1888bd566fc0b3da97fc5f8aaabcbb102ac90728cb4ce61a2d91bd0d9b2a69948df8f14aaf1f6ba7aa882611b864bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b595df8233a98d8a65ee348aca8153bf

SHA1
7b21b015c1dba5c4e1b33c9a62e79264e2a49cc5

SHA256
871d6e35c43531fdf7fec298c6ac67efad2a2b8811a2a363acba0e0e9975ee80

SHA512
6dbeb7b37893292e5715e7251e75abe6e9ba1358b0cce3a0742adef79653a9c4f596ddfb7fdd25ea6f7241832cea67aad4f368937f1e304206d472d8c2fe32ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f4a5f99f0a3a78cb786322953d61309

SHA1
eb29a18c542b46452291612aa2b9efee32ef3058

SHA256
3e8a6acb647e06315964526e56eedb9b15909619f55baf9e6b72aab043325d46

SHA512
3faededf82c229f54284176f47722f8f217de78780426e1eb782a6b3259faebc81fceab8eb573a7afea25b1ce7d1ce27a76096501324ceeea26d1d7cd93ca18d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1e206424461f33772abe4a442c57934f

SHA1
3b9a835abeee25971a1c9c32dfcfeffad209d821

SHA256
2940c986ecd3b8f1228cee9592ef24afb14aa1eb02b573930b46f2b145a9d30f

SHA512
b4c0106eaa211d0a7ed6574cdedb0128990a63322f4041f715e0c9f1d04504df483ff3aab685945a1c8012025486abb2b7f3d3c93d40196a3ec2e8d7fcf0458e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3cf64f0a1acc8b525fdc7e42e1129c1

SHA1
a5610a15860bf91f5a2beac05243398fe424a029

SHA256
b858910db9652c226f25fdcdfa2db3ce095da1aaf7424eac4e29f54e3b930ae7

SHA512
4aed94c590ccb0bf7489764c8aa17d9043c37fda9edf066f75ea35f991853178b69b4f82d9d04a39a50202d551933726240978a318cea8172952a110eabcaeae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
3cd05c8ee41c21c6c5543394734cc4a7

SHA1
ac15d8714e9862d882f74108caf2729c02f4a024

SHA256
fb13ef56d6a6ff597a4748ec4b6d6b9c267fbd28c5900d6eba6a31dcda7d8e6c

SHA512
8643107999a394855fd25c77dbe46639e2144be73e9afc548483738cae72576150d66fd919ff79673e006e36075eefce54fb6c2accff3dbb676a7501f17219c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
8f11613960426f0af92b231ccfa7707e

SHA1
afe32e4916b64aecb4fb5373fd255490ca6d13f3

SHA256
82856174291a4310b45aee6a0805093f83acb16ae1eac1685289aeaadcda9c40

SHA512
ef2897112043057d6b41a27a79065a4703aa4d0cee6db780ff23e8c36e9677844a6976c859d572824a623e37d251b721fd909c4f8b316867e4bc7a76de34c6da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
534B

MD5
7516d20a79b79cc08da865316789ad21

SHA1
b353bd6dc9f9e87a6b5b95f359f370de977d6c42

SHA256
128dc247c92d521e09522f845a588df16ff22756b76a35bb1158bde62ad78403

SHA512
79ed62e1b78fdc6bc0384b82e2df60586dbe8453bf59411bd0fd64ce1d46c446e3ef8850f8f90d661b156a92e70e275d8332466621740be61d1e60b4cd203b00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
2834519738f54e4ce4804d26f9a4c1ce

SHA1
6665b445de567d4754c71a1cedeed844d51fe3aa

SHA256
fa265fa37ad2fe03ae8515632de6b53ab2712e0a2e596c2f7ae81597fc1220c4

SHA512
9c28ccf8bb0dd7c0d1c2772f813575b62beb5239e8b663e3a4550c6f5ab7efac1473cd8af769a72e5ba0817c045afc546a766efd57d158ed27e476a7c4d69a10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
86f40dabca2418c41be500dd7c92c3fa

SHA1
671dc462fc8c0fcd205ad9b64fbbcda219cc8460

SHA256
4d0aac252ae33bfde6d7e455dd8a17f07273d603d2cc0278be3137e1ef7e68c9

SHA512
0bb22c2bb5a002cbcf220482379ad9c4b18b603c43502e1b561b2a86d18fb5b15ef6baf736d642983f90407d53664bdeaf10af74735015200425641babfbd8a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
238def1557ee8fe1d46f20d60735786c

SHA1
d7267651c362caf6ec6c46d25039f37cdbd7e940

SHA256
c2370ce2677d4a56686c13dae775edb8740f677016d3402ba41af859cb3b37a7

SHA512
bc2ee1f35aa019b645f8ae854fdbbaa1704cd0343e3dd3d5e91be6d4100407a88292a3e05e4f87a8884f761e25122fa1c08d4e81dfef806b575f8abe9dea69ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
266c17e018ab6b11e2ece4fab9a9a145

SHA1
db6cde50bddeae25db110be94bfc3eaede9e4f3e

SHA256
9e6554db07d9b1858c7c4af338a2d955ec1b855af06d31a902431c33a6653027

SHA512
71da81514b750569ee8cc5e2c5f5304967ed176c25b770c5dbb09077f1e0c56703016425aa01fa84f0486d93954a7426515c1f0ee63909e30089e3c3b7fb8833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
534B

MD5
9695e33a8326ee0cd654c40a082278b0

SHA1
53838e49c2adb05ea3eac4edb25c35ce9c9a1e40

SHA256
87beb414f84767a149e5b8c1a29e261a6daed2945ee4bc7ede7373212787995b

SHA512
5a44f26528a6cccc9fa8a53b2e34299fa263913665f746a5660bbecb817236ef4a0ed5f6e68e8bc4c54b05ff4d4dbb19c1b29b7702da0a98c97c28df8c4fa8c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
fb5104f81e9d0a75b431f4f0875c9bbe

SHA1
03f34b8601f92e9c5a4f96d7d36ed9441738e798

SHA256
b53bb04861cc60f0fb3df1771fb885ce8ccc3ea5f0375abe2fbfc4cac94eb10f

SHA512
1877772c1cd4c9cfc20ced2610b700d8c5385c33a76940c49f90fa668bfd6c35619a51b81f3a1f4913f7ff4a9340cf69d3cbfb94d616646fd5eb08b328df5c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
58652ca3d890849121887ff020cc233a

SHA1
5086e529f3e642091706385bbdd1a181b9e3fce1

SHA256
adfc82ab1c8d0209fb08420e73c5b8b4d7f99445a8b0ce03994ff9aa1f794ae1

SHA512
ad1b2187feee5e719fc33dba493853a4009def91e488bc85dc8074692952b1a7f8c8ddaba3719a828d616dcf09419040be61b7a5ac7c6e7fff87f8f5a5c0aa60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
17e12dd5206a713bd1dcd60835c54bc7

SHA1
976c6353970e537150bb123bd4b6ae8f1db12e21

SHA256
4084fd6dfce09a961349f4ad3899aba8650972e2d81fe30be6a4db65f723e0b4

SHA512
9d60d14f8ee13cf052094833a7fe5a017dfb97dddfd68793333afff7cabb5b9028826d8096a1ea7744ab99068d6cb05aa2bf0916d40fb7c0b6862bb0b21798e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
1230ee650179e1147d3e03a925ad8987

SHA1
0596a2784fb795084c7601082ce2c7f45610e429

SHA256
7d4b1d2a1427f579cacdd6440790181e5e43674385229b574ec03c3ef09115ef

SHA512
084c45957397df778c5fa5bf27e1d6eb9904d707cbd0ab021b7331003667848a541432190b113a6d9e819198e9ac48b6a4bdaa178ad399ff64c4eebc45eab6ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
9e1d6212c3f60f9232b9d2eb72af8ec0

SHA1
17c0c622113b0cb76aeefc5980a7f2a18284cf14

SHA256
287762bcd55b0e5f5d3d03a8244c2e23118c6dac240e57573f50a9770cb952f2

SHA512
adb43439c1cea073bce8acda195da09ff1740e5496ba7851032f91970c8b259a19ec402a046ebe5192bcb7bd638cbf2aa4794c1006e02d49c59e6c4abaa3a4a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
0c0a49092cb790a22349d4e1d27cbdf8

SHA1
19f04940e602423048e60a382132b19835539a3e

SHA256
2ca329e17d1a54743bc4d00f908584c76620db252cdabb5230e527ea862d7589

SHA512
3b6b3bc64836ede67700acf3a8e2d2ecfefa6bb9029eb646f8ff81c9d4c9735dfa34cdd76ce21cbb47513a46fd6294b0010fcbfd190076924ac4661f483100de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
3f48cd3224acfa1f3739d538b8d8fa9d

SHA1
f9962dee5b427970e124e2f03bc350ff8b010a31

SHA256
bc2e819802db6e0c5e9b59b6cf6ff6d48bcdfe3405ee68f24ab0c93d25dfbeb8

SHA512
379581bb4bfbeada80a177ba39c0f0d1d65f74fe857a14f4f844df6500bf0ad2b1f9d64617ffdb00c5323426a555463de2ce1a7da74378cfb486cec058f012fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
534B

MD5
07b77fdf4c207c21d80977baad257570

SHA1
dfd966096eea3ef182e08b3685bbdf229153e341

SHA256
32ff3b6e9c2b5b48ac6839b2e2110435c58b06042da86d317f8909407e7f9da2

SHA512
5d3ddee2915b857f3ff44e2f6e118bbf3f9ff6679407c223cd5828be6db5fee28951da670f5e01335e893d6c5d9dda2333cbc992b4afca2b4a57a06d362f36d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
ddea7908688a57cc7406da6a4c673a64

SHA1
7a5775a37fb63ef55055a173704eef99c1ed700f

SHA256
33ffb54309b1da879fb9e87056d0d6650bce899acf54fc67a0226dbced5b7b90

SHA512
7e4f5672e3601e2456a9427d4ae828f325d08c65c5a7cb6e1bf8c2b1524fe96824b6f20d6627d267171b80f2ab2527836fa61e69aa60479c4de51ab51ab779f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b43c.TMP

Filesize
538B

MD5
96884e117799235c57a62c017f8cdfeb

SHA1
572791c67908b408ecfca2da48ae65b6c66c3775

SHA256
acbacac6bcb2be22293e8f5a8c4d3d8ae078c42b3da878d7628b73523f53e37b

SHA512
765f4ec363cfcc0c5d11bc1f87ec8c849df040c4473310a3ffadf36d77e0ac84eb8aa4150231aecf09874dcfedc98e9a6a9e553583a317366059f61515a6545a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5bc3cbedfde6562047d62dd275b185c1

SHA1
afba2f90e4af6fae526bb90348b999a80218ff67

SHA256
e34f90edaa74025d5b0af24367e422cce071e33d370474231cfc4571357b4bbd

SHA512
1c29f64e0b6e3ff9a2cb676765da50ad1a395c162ca090881d12c98229a6a7153ce9136ad0af05c899dc67bcf4f46a0999737c33b7baefb820edf397b668bda8

Download Submit