hxxps://www[.]dropbox[.]com/l/scl/AAAmWa1ylBmWSmHUWE9syxfsUyLDDsir0xU

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/l/scl/AAAmWa1ylBmWSmHUWE9syxfsUyLDDsir0xU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1497073144-2389943819-3385106915-1000\{60ADAC91-C00F-41CE-9C67-76FE81D8871F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
5044	msedge.exe
5044	msedge.exe
968	msedge.exe
968	msedge.exe
1076	msedge.exe
3484	identity_helper.exe
3484	identity_helper.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2720	5044	msedge.exe	85
PID 5044 wrote to memory of 2720	5044	msedge.exe	85
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 4920	5044	msedge.exe	86
PID 5044 wrote to memory of 876	5044	msedge.exe	87
PID 5044 wrote to memory of 876	5044	msedge.exe	87
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88
PID 5044 wrote to memory of 952	5044	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/l/scl/AAAmWa1ylBmWSmHUWE9syxfsUyLDDsir0xU
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe221b46f8,0x7ffe221b4708,0x7ffe221b4718
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,9522510080836646296,39161955426268314,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6396 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4624697de60c2fa38a49974612a615e2

SHA1
1edeb05e2d0645f96a03a4079a1fcc5d1c19a493

SHA256
dadfb228be50b46af69e8c9928a5f76a1599b1622fa21f94e386bd76bc20c751

SHA512
c43aa3b3d542564bd1d2114b0ac70ad0f11fc90c446d85ebee14f5dec84caa198be343238ef4502b9a9e9be39380235f3f4399846267359dd1b14bb9db30b014

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2efe370530b139bfb6c997c8818a618a

SHA1
d56fb2596a5a1d81e5552b7080725cd6ac793dca

SHA256
941c081401da1ae0b21a634adb0d2546722f525b2b9e0fb5121124379d242d6b

SHA512
373bf55dd5316d693b2a5f3655785ea9403dc20f5dace05b4a1053c3c008e7eeee68a8de9e56c18c34b67d3b623d1dc23eb3b408a42cb5714df4e22d3c0d2698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba12851bb15e7818ef7a9c865201f331

SHA1
b79f057653ac67a2015fe4fe1d1159f8eedb4278

SHA256
921f52655b051a4775ea41372c1dc471061d7243091bedf707f8c81d419ff306

SHA512
d7c0b672813a06b0ee4c9e4e95f411886b07d7cca769d33124042ddaf9c8780f595489d707ea40fae068a4b5125d45b3f775c8f3092031a58d5eb9e3ee7d72a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d50921289e54f97d25d9493a31a2ff70

SHA1
fa7c3d15bae95c05f3eb4d067ee243ea4284edf4

SHA256
2aeabdf266d600eac948b8fd474d7aea9e52fb4a4e0c6f1ace9c61ea6537d4f5

SHA512
d493484b75c6352a646c8f08be8fd721b53de0091e8f34d8016e729eb6c373f9cff05d91efb6a4d06d8772a601da22b68a776646b89513d45e6ea8ec4b7a4419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e89bcc492be19e74f9f7fb14a93c6528

SHA1
f31f98eb43448a7a4f391ba22214da51b25cb5dc

SHA256
f516279d140e142a2cef29ac7fe6e82439ffe2231f684e47ff9a12e4bd902772

SHA512
a600d2b80b1b1fdc549e1eaf31bfd2c425efbed98c08de1f439ffc14d9e2d23167e63954ace2e1fab101089970bd4e0d39b3cfbf897fc4b0c9d843b75edb9f82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
3d721ae450259c62ca9b58256df490d0

SHA1
b4aa234c1e530496dd4c278241578d8e6e350d12

SHA256
1905c1cf4f3e663d0693181dc1c98f98216379dd802110fb5fac6405a2262f07

SHA512
3a4d3aac32b1202d2d692116c00d15d804a4f09276bc9d57e1df2cab377802e4cbdcc7fb05d297f104a3661d9f0c26734d967d04d6c81970801c481121bb5ce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
5596a45bd57530746d442ea878b58670

SHA1
22390f9d4d92fe037cd0c8b29f471b06cc91466f

SHA256
e6a13932f36f97cfa313813888264b47b8d47b24cb04ebe6b334dd0f3cbe534a

SHA512
9106662fac765b9b2a1137e5ef25f5e436a56ae0df4a02583a2ef24f206cd63e43d224c7c38535ec5c73035c25d703add8505d729866db4856323e93068054d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
9e56d2aa2e1dd3f0111e2f4997f7c772

SHA1
41adceb8cbc961b98d574bb9dc83f801130afe30

SHA256
af68e5893afa5f278a232bdadef417a6565eb7bae379fd4218aacf5823980122

SHA512
653807e9ebdd39995125aaf74da725abc4314ea6b92b624b9e3c5342bf2e263375f0d17a2d839d222038cd228ed0909a396ace720288079e06e5e44b11d11400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
fdd3a6c745f1561b875f252f22189656

SHA1
dff69a2926f33f4d5f2f935cbabec225c8cc25bb

SHA256
6089aae6c626d65e8664fbd9f79a9b1006edf10d9f0c134f07284acc00d8fd82

SHA512
f653041b1ab9c1b9151b6108f38eb26c33d900a2078b87f0b2546139d1ecd60de2ad1147787121f3421df7246cb86f3c6a9098a7d9f3206ec11cef0e3731c63b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
1adc61767b978de7fce116fc4d2ed18d

SHA1
e40f19fab543ed44f54597697f9cb7da9f4fd5c4

SHA256
748c66d4cbc32914e0f3ee424ff45e78b9b8eccc5d870e037b10171580c2d476

SHA512
a696d8404471734cafec712809d8562681108c0eee9a1bf96cc4e11eec59cda7832cd172a1c154cde475e9bab8514422336599dcc50efd9a563d73cc4f2c05ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
87c9766390c7b2d159086494ced96ca6

SHA1
cf34a79afaac78451350c12f60b075eba2aa6d78

SHA256
7cfa252ac668783793b501b477f303c42dfeb08067fe77fec1ef23351c4ae608

SHA512
8fda1b77e177f4cf537e1ba3cf54278dd6f9dcd8bc565587c37b337f87cb8f5bd61dc4af4aa9714e71b022dca813c97f4c346d8e96318e75cbb687445e03564f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
1457e39c1b12f18093eb35ac21cf4f08

SHA1
366e8f1e75e3d01aa76a36a8b0db375cbf5643fd

SHA256
55e007a92f6b3e8e0b4e716a367c25efc6c4d0922c04ba1f31ba8ada596e9e7d

SHA512
ccb5322789192639549e62013ca76f4617f2ef97e29bfd0bbf7c69492a50d842d2d9e5a396108a426165b4612a68f51aa19dd53557d716798efde8648213c9d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
33221a140bf8f3afbac9b5017c8a7cfa

SHA1
2d255d6c9e6d91d3c1898f0116a8479eb4ae9d0f

SHA256
ad2502b3394e0050e12fcca863b8f44ec8f38c45f931befb4274b39509f3c58f

SHA512
6747761edf6d4b36ee8a50abcec55166a681a4311ff76c7c2dfeaa5aea359a15cc4f84c240d83dad1df48ce412130481922c716f8e44dbd13117fd9423553421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
dcc62e8c5649e67d22f3889cb6290f3b

SHA1
f7b0587527dd1404689c880dc4c615da5e4cdf52

SHA256
8d8d9fa9c8111ab3bfa5d2c63cda10163c6cec5f5a9969d7928d5528a81fa7b7

SHA512
4c7ef5def692d7c6d04d6e6a71fa0590f71a4b25ecda636c49a3d7b1031ac8ce0443b6e28c5d6d8d61d3041a515cc83c9cc93343fade5377580ebfee7f144509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579a6b.TMP

Filesize
371B

MD5
b782235cdaf83a6c3935506ab7a9f359

SHA1
6e30cfdcf8a38871436c3de0942d907b80975c48

SHA256
32dab758ff5c735c962063969ab0f0dd5b6786049e7ad5996f9b7235ace9fe97

SHA512
0631eec7e7d44f61a7d6eff78f7545fbf4a2c8db7a5cde62166d8d17030f47cce0974805be05d76b4cccd9cf14ee32996236ed41149ecf26f1003ca520bdbfd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\afa98b06-ac56-43a6-93eb-e980d5a46b3d.tmp

Filesize
10KB

MD5
5248471d9910d64909aca1df521d1ac4

SHA1
62e1f1b31fb184af06809829cecef3b469a451d0

SHA256
9b534537356c1f945a2a10dc3eb2020e19f76554b6444b3831b2425ddbd2c517

SHA512
f93871dd17e56a50040abde539dd6a7430c67c2a2117b5c4023fd2a3d8fba108cea90b0a48b384c0d27b2b3d524474e1bf07e95d3be3d7dc8860bcc5ef8ecba0

Download Submit