hxxps://reviewsignedfile[.]sharefile[.]com/public/share/web-s38d9f3f723974e06887a52d11306ae3d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://reviewsignedfile.sharefile.com/public/share/web-s38d9f3f723974e06887a52d11306ae3d

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
88	api.ipify.org
90	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
628	msedge.exe
628	msedge.exe
1280	identity_helper.exe
1280	identity_helper.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe
628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 4852	628	msedge.exe	84
PID 628 wrote to memory of 4852	628	msedge.exe	84
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1584	628	msedge.exe	85
PID 628 wrote to memory of 1204	628	msedge.exe	86
PID 628 wrote to memory of 1204	628	msedge.exe	86
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87
PID 628 wrote to memory of 2396	628	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://reviewsignedfile.sharefile.com/public/share/web-s38d9f3f723974e06887a52d11306ae3d
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb346f46f8,0x7ffb346f4708,0x7ffb346f4718
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,804072576000615253,6452403913666742709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
151KB

MD5
6e08000ce5c4e9557e681736abdb6d86

SHA1
7fe646168ef0f3b76ae106a42bbd59f9f15391d3

SHA256
a4fb3cc2139d8b8a345847e68cdbea7d978c582960dddb6c86d4b1f26283dbeb

SHA512
d66262fbf38d1c2b073e07ded7a15df4838b6b2b0f2e3b590f21cf7535ae2ac20cf494d26bc88402a567ef7450c6c7036340386d6ef9bd2aea0a29641b5392d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
30c11e77649a672e429c0055e5e8ad6c

SHA1
76afee72a69e4e0e61710cc78f84d4a61796e5fb

SHA256
f270943f4a9b49f3ee877b8719b2bd1876c8a454229bc48033173d5de2d6bd6b

SHA512
f70e60e91cf17bc2eb5847d5f3eda59233f4ff638dda70e01282a79fe2a3fab1ab3ead2fc39347fc9edcb96c26026052047900bfe5acae94dee77e75ffd5795f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c97c144ed007f6d07a94a1d7a63d7762

SHA1
ef6b07a11f17aed7e0e1444ae9245faeb9d3a391

SHA256
220e261409b43a022c77876b994b04a7b1ddf4e87990f626a8ba9d655cf3a173

SHA512
e6e025f8ba1f6ff15e3b4bac88c044112c854d4635130a17067a822edbb0a6ab611c24df9b08bab1c1a0b5197e2d9c2387a14f9d1ab556201d439b686bb18fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9851c49a491dbdd7b77f7deb0f7f7a6c

SHA1
f0477636e6ddfe48690b056d13f88ec480e0522c

SHA256
c81d269dcdc04e142877ae694b20d602b9c3d7518ea9882ceddc42d5a334b3f2

SHA512
19602ddef5687b77c7ba2207f7463392651e18298f810f4c3a6334c321ed6c613da679df7aa69e80ca050a0059311e4ef18790e9879806b1717c14105e46b16b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
deea09a795d8bb4e9566fd304fd439e5

SHA1
cf4b0ae91a2c544b73aeb7e675ad0da78b65c9ee

SHA256
e9c1d4b1cd95f59b7b618d1ee0d9c0fd37946a6747336bbcbbdb07b5bffeb569

SHA512
96a2730b745810352a4b7479dcf0b92ad05cf6b71ef128739a65db49e6e27cc027bb5ec63f95fdf085f435f2511827889ff41948e37742f3f397a86c18281d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
28f5b17b3870490ba86fa0e777355747

SHA1
353b5d7bc4ad77f42168581326a01739a192b7de

SHA256
273ebd7d887ac363cc615a3966ad8ce95d828caac35d3d7f3c99ca7e1065287e

SHA512
b7b19fd9877ce1747d4462210ec64934e6aee74df0060e7f79ee5d94892cada9571bda22c293f481a9db6a07c1f366bf50b6a435f8b781c4d2b60ee37c531306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b298283b6675b0b1ace799de9a30a37e

SHA1
1e082debb3ec0f96bcfc256a49fa094ee40ddadf

SHA256
906dc19d812ecf3752ae4b58450f7b1abf7b22df1978e98cb368f7acab63995d

SHA512
f076db51b2cafda818be71a7d7a625fb0b1d1c90f4247082f1adf5401ee9cdabd24d2676976ed1f9a49ae9a0b971acf8294672a3ec0c5f68409d926f408c01eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f5a9f7340bac2dd4ae42f9a72802500

SHA1
38dbd2574efefbcf7ac39a32a7750bb494230b75

SHA256
abd834bdbf283dc2542eb03afd5072305db257387b2c61aa3ca14087ba1f6988

SHA512
f8828ce653b8a2eb59ac3f49d087897be9cf47c8bc2009779324a206ecc737b56dea859370422957b7540ce549219b95beb9ad0e9ea81d2e703f68401a405e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
92a0b3c365bbf2466c4f5be19fbe73be

SHA1
b4fe0316389e7032642ce54aaeb42111bbc9ec93

SHA256
aa015376e316623ef5b022cd4252f9e0201d01ef8ead7147e6c784ed12af63a0

SHA512
129362e8121ea7f564178238da1d8e02ca09d55feef62da96ea7ecc1595c3eb8be03baac30be9b3f70535abdf8e1df1169d48212d8d0556c9617493716c1092c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584d31.TMP

Filesize
1KB

MD5
38498d7d0f5fbde4ad4728344c2b2e22

SHA1
e62c8813776fa6f5e353a479e7c4ec122c8c3f0a

SHA256
d1b2c97f0519ea497d3d97898e1c51aea641dcaccd43fc653e0a924670ed833d

SHA512
7ef62e5883775bb8af695bc2ea52187a29dc7380a211366ff46e481b4e24ada445d4cc846ab49b2f21057ff48b0a1b5ecf1f4b53099766c9a0fd4d0c9e4cfccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3fcde398c73a093618cb5e72e7bbf99b

SHA1
aca8e0841f80c6168e6e644b3681a52709aef585

SHA256
2bc3d45c7b018dae2b8750cd4f7b6664490bb72e0c1cdb10b36a02985254e4ee

SHA512
b8b9396521c9f8c009a43d14ca69a013ca3fbc0a4f0679ccdc8498442d2c89ebf7a25335afef1ff9441bb92a0c8f2992e1a43756a6ffe751a9fab7d3f55d5095

Download Submit