hxxps://www[.]dropbox[.]com/l/scl/AABCisWtAYzRSTrKi0iTmEpSvZzvnJUJJcc

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/l/scl/AABCisWtAYzRSTrKi0iTmEpSvZzvnJUJJcc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
920	msedge.exe
920	msedge.exe
3616	msedge.exe
1668	identity_helper.exe
1668	identity_helper.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 2456	920	msedge.exe	83
PID 920 wrote to memory of 2456	920	msedge.exe	83
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1548	920	msedge.exe	84
PID 920 wrote to memory of 1540	920	msedge.exe	85
PID 920 wrote to memory of 1540	920	msedge.exe	85
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86
PID 920 wrote to memory of 548	920	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/l/scl/AABCisWtAYzRSTrKi0iTmEpSvZzvnJUJJcc
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7fff9a7f46f8,0x7fff9a7f4708,0x7fff9a7f4718
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17979939469013264562,3313710695278987782,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1c034508133079a0f969be836fbe93f9

SHA1
28f81b30f757eda1f4467d6ace9f482af4a97dea

SHA256
7ff98d5848ab3856944857d7174c77ae48c3fe7005373e35c042d8dca6464d6e

SHA512
726aca8501619146584c0625675337b12175513a27f9cff3d58615ca00385f42acb511942b8658ca5134e9fe5abb6b2287f95abdef1dbf67f949f4d720e9056b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f8ca15b341f86a63ab41dabc186ee0ee

SHA1
7709d179760e7122e6304e344b91158140a02488

SHA256
8da152804fc59ea7c03470a26402534fa45b1f20e3054df98542520ad4d0b472

SHA512
0cc74f15203125ed1c4da942375f5a85745a3738c401ddddec186a288c0c63bc6a9a12cba93443a77686b0e19f75f74163e013c51fb168be6500532f82b64429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
acac283831d6bb11aaa8773a395b4601

SHA1
556bd5544b05dddcc74fb2b48f72b37a421bcbc2

SHA256
3a2fe541f1cec35353708af3beddebbd6796cddb0943deabe01d10e084b5027f

SHA512
ce45316dca155e642cb4fa09585de1928e9024797a1f1316c684e0bf155486122068b89cc59b964281a14d44936c6e7a3bcf6f3c5929d51c6d9693753767b7ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c8b450c658993e734bd12a89fd92b4b6

SHA1
955c1430a197dc7982a343535a2c6f89bc41aca1

SHA256
c305f08473a8615bc6afef837366f777c16636c31d051f851695f969758498dc

SHA512
4ae95cf828cb16a63070c335b4e34f960c50174a79883455690125ec9e53df8cfee10ea02edc9f2d749b4ef00689b9c7ef8ef3f566cce60e0627120258fb6ec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
6e1ea976e3b5daadd1366a51eef86bb6

SHA1
5fd3edf91fe50f1598a7070ddf14a7d03a26762a

SHA256
f610a6edcc8b973c7b4b2d719f82ef4a58e19a0b7383e619597e4f5cc69fcb0e

SHA512
f9a45210b52645f9c883ad62c36fa39d3accad7620f983ace31417f1ab79298e3fb65d98d100f426b7a56469cc0e9851bf91ad876e1770d6b014f3a9e015ef49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
53584da4b2e074b6f69a4e2790415d02

SHA1
ec2ec458c28c3eb3945e9530d528cec20d495bd4

SHA256
3b4c0a65b0458606951f20cac9b6945a9b27aae55871de7de821da6175b76c3a

SHA512
90267ee87fdf1dadba3a546207751fa5a34fb866418ff9642cd9ae2d0718b2fd0bae207816ba713d690f1cda1f2a086fd976358703e5af7cae587b5695c6be38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
d597975990aee58d262a988be0fa53f2

SHA1
4995c79a7e2412f9f02749b0430ade6a0c7fd064

SHA256
5dea1923968b926c92e51a4ba354d3eab6b465fddad28e0c3dd792c9eee96d28

SHA512
1c95caef6117d53bd22905fab058fdbc8aa6e215871872648906b1fd81a6862948ab10295051bc1f84b895ffc09f0d8e3f6a5342fc4b0622a87d22bc8a6805ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a76d59fd9ebbd4f9735820c428f064bb

SHA1
6d11eaad0726570ba0bbbbd50e3410c4c872ed59

SHA256
5b17bc82953538b29490e01664663ee148c78fc97efa6dc37a02aeba4376af26

SHA512
dcd6d4b01641c6dfda9c55a72ec7b01bb67903fd35b3bfc192994ee408f9a007216ba5e4c26ddf3944638fc847bbb56d9d18c246d663c00f01d74201069aadc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58027c.TMP

Filesize
371B

MD5
0d1b18db567fbb346d4551e5f3ee46d2

SHA1
00a5eb7d7c2ffef28013f59f7755fa77cedae3d9

SHA256
045d105710294d10fc6e0c5dca0050aa83a68750d3f2314c9e5e285d9dc2d5c9

SHA512
87a7606b56207c151ca9aaaea60e966cb181dc27c1872427137e972692dd95d6a619a19f6c3890c88a5dc3c7564ceafa250a5da8abf47b81c9f51a686e5b8ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c94a8f7c267283917c134f882ac96e1f

SHA1
20093a176d1dffb3d0313ce1bf306b14b12b020f

SHA256
5aaf998cbfabcb74c3b032a6c0b27299e2ac0fc64091e551404c10210077f02e

SHA512
bb749cf06a7b6828938d46d3d2f2c09c6a325f81f17408cbeebd80be716892b30e9bafc7ceaed3ca091a77adf9174ec2265bb47e4ef186853d496e85abcdf1da

Download Submit