hxxps://www[.]dropbox[.]com/l/scl/AABx5dyW3KH15WFnzgh5wJWpET6KJlly_iQ

Analysis

max time kernel
63s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/l/scl/AABx5dyW3KH15WFnzgh5wJWpET6KJlly_iQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355664440-2199602304-1223909400-1000\{62A06633-94AE-4ECC-9676-45CB29040F23}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3880	msedge.exe
3880	msedge.exe
3272	msedge.exe
3272	msedge.exe
4564	msedge.exe
5196	identity_helper.exe
5196	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1144	3880	msedge.exe	81
PID 3880 wrote to memory of 1144	3880	msedge.exe	81
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3084	3880	msedge.exe	82
PID 3880 wrote to memory of 3008	3880	msedge.exe	83
PID 3880 wrote to memory of 3008	3880	msedge.exe	83
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84
PID 3880 wrote to memory of 920	3880	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/l/scl/AABx5dyW3KH15WFnzgh5wJWpET6KJlly_iQ
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa67fc46f8,0x7ffa67fc4708,0x7ffa67fc4718
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17581515514683740695,2154170887948886522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:5664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
36KB

MD5
200cd59ecd27d6747d525cf933aae56c

SHA1
8f955527e5a43b96861b9d5d450de693e92e8b40

SHA256
da0f26a52f95585a84691188652b1529705fd7996913d07035e28313ae9d715c

SHA512
b7f7022c9de36743b7fe0d855d52def6b152860cc442f50ffca7f7142749c88661710456c26783219e08fc65711dee66775d792cdd929ee6fe6a048e1630c8e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f8f0701092d9857e4f5bd0754770ffb

SHA1
466f8ac08a32799e9b8bb02020b0b4fb7cf7f043

SHA256
f9fd801ca6d6e17623d64a2dd58041f93475c752d6ac914cdea28be48c21fb5b

SHA512
80c0e098c52ff5573219bda8a41eccc23abd92c5fd43dc998ca59269f8bb05f440dbb8972fd1e49a0bea6c238c06a8cd9ce9f2247d110f92280541f95bcf769d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3f3a310d4528bef5ba544980e24a6f8c

SHA1
470580181bd03e621738a3ec449f234f3ba30f55

SHA256
4608c51fd33873e05129e33f82be6e895578e75bbe5624bce089773082466210

SHA512
c65123b2bd01fbe673cdb8567e5962fedcd8ab78542b6773047dcf3d176c1cf3f477ba0b238d37154bb02545cb4a95db8b247e492fff7a09cce5ceafc2168b5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aeddb4ed3bca523adfb7ebd5db3181b0

SHA1
e96d74e5379dc6530e7485263a5fd85bf44fef5b

SHA256
239a6a93c2bad4cd8c885626d764a4258c088743c6e6be1bc6bace6703715931

SHA512
f8bc4482df87f5157c36f0b590ce0eea67c10448438cc0ab6032a41e59ab10da4827ed2995ae105323eeca48c8affc48f9c2480993c9b9c42d75e209a4be14bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d0e0f310542089b812d2b36915e55b73

SHA1
a6fa7008b241921546fa5cdbc05d803d825d8454

SHA256
6e8b19084a63f4bf916533fc50a58f72238cbf6475cbe223f3d28faa8d14cc11

SHA512
30e3c5a7fb8dbace57aae406601a4ab89a06ee0dbf0a7184a8c358ac6ae992bea51d40bc73498942846c8e54e6def9a345e4472dc8424938927f4fc873e8cc77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
dfeef3226757fb13c8c3ef028440d80b

SHA1
1e22ea0206a6799e6963d199ab1c75ed8203996c

SHA256
7afe2f87566a4fdb46b46255740e80ff4a44ec254c8e87b9d26e506cf1996925

SHA512
86c1595e4432dabb02df414902238d0e1926398918dc012b23385166d4ce9e7ec11ff9166368ff26ba6066d23857f8929a2aea2c9acfb944d8bd7e904babc8c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
593036fe2bd1b3e0f7923f0da0a4cb9c

SHA1
59befae4a62dcd429d28cf4f9c5ec67d4ee86dbb

SHA256
7f0e17bbabe1b8bab709c4d3f654341492f7957a63971ae0a7416da92bc33c78

SHA512
75a1be2151055e2709e2a2a8dee785d07e56e4d3c0ce6c7d78139c9d3e03fed18776452812dbb84219f75ff85d9022bfe8f310c867545c1c4c0b740f5d1c8e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
cb999811ed5225c35f94a451e6e10136

SHA1
b2528ef10c43e13f64af2dfd7664b04b273fe1de

SHA256
dc205d9b19505d021721eb8822db28a708952507933c52250137bdf2e562eb95

SHA512
b57d39dc3a0db28d42f6e4e463b3a4fe00b6d6e585a75df665fe57ffa20fa106cdeca110cb4b92c5e55824217eb6e7114cc53bad24918739d016e49b51b5a355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
972e524b3cc543aeb91285beab3726bd

SHA1
18b025d32ab5aa41f1f99baa577076c86aed8814

SHA256
1b8f6c484b0619713d2ca4f4ea4836df1e1edcb47fcd4424065f8a16dbe66b4a

SHA512
8cebfbcdad974d7f5d1163b6324a4f2fabcf3ea8647019249d2283fef3b2fce005d89896e8f6083ee57e7782fb12d108d133ac803fb33c274dcdb07b5530f041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57857c.TMP

Filesize
371B

MD5
52aab72e78cbf005505e8184e67c67fb

SHA1
3e963b29804fb74609d521a2e3178dc28b45537d

SHA256
992d669df9589a867efa1fa282f9c1772ff41227309c4b923a67953463f14241

SHA512
bc24fc8b5f22cf250a0f136adad64ae77319f075c4110f379008c4c6bfea2ef8732daa401e95777aada96a5168acd476ff6a4751c77b91d4db1115ee2a63484e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fc28cd1a4660fff3adac59b821d87e92

SHA1
9e9b822ecba22936f5a2902e77ad7b143eb45675

SHA256
b95c7e1300fb6fac533739fbd88f207934d82b037c2eef725824208bc3f76f05

SHA512
3aa9dc5eff0587d48b9d8470b5d7712b8dd54946f0c7cd29548e71ca7db054b7a4b168992a4530344fcd5feb137ce9894948af35a761fea4c4170ecc1487c6b1

Download Submit