hxxps://www[.]dropbox[.]com/scl/fi/qugxhb1t9d1cuxv94ub2c/ShareFile[.]papert?rlkey=rlrl1cwooe5rh9rqq7okaootu&dl=0

Analysis

max time kernel
145s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-01-2025 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/scl/fi/qugxhb1t9d1cuxv94ub2c/ShareFile.papert?rlkey=rlrl1cwooe5rh9rqq7okaootu&dl=0

Score

6^/10

microsoft discovery phishing

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	dropbox.com
19	dropbox.com

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe
4512	msedge.exe
4512	msedge.exe
4124	msedge.exe
4124	msedge.exe
1908	identity_helper.exe
1908	identity_helper.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4080	4512	msedge.exe	78
PID 4512 wrote to memory of 4080	4512	msedge.exe	78
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 664	4512	msedge.exe	79
PID 4512 wrote to memory of 2888	4512	msedge.exe	80
PID 4512 wrote to memory of 2888	4512	msedge.exe	80
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81
PID 4512 wrote to memory of 4476	4512	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.dropbox.com/scl/fi/qugxhb1t9d1cuxv94ub2c/ShareFile.papert?rlkey=rlrl1cwooe5rh9rqq7okaootu&dl=0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa0a1a3cb8,0x7ffa0a1a3cc8,0x7ffa0a1a3cd8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,2084302187366073529,8889497453568834171,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
28b9a125e75403e76d1097c7a08d0306

SHA1
c3036c8b895801b92d330fae4ea8b654daab2397

SHA256
82bc9f1ce7ab7122580a73fe8024c4ff82fbcafca45cd5ae169123054a310d15

SHA512
66906d63c4d74320d2f077f865b3a9e2b45afc6b1bcab07eadb2f6e1e56d3e72b68c25df5c039da1ec13266caa0342d4cc4934cff7930359ee53737d1911e4db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
810B

MD5
f6031d7525b5fe434bb7fc97f4f2eaff

SHA1
08856dfa2035219774a0905fdfffb64fba026b21

SHA256
e01af6b8faaa3309052298c1fa21b282ae573ede19c2553abaac67686dc32d0a

SHA512
ee5c32cad906db857c39ed9a06c6f1047b606410faec42a586cfefab64bbbc10243f40e106c280ae7fc2e146aaea0a12d45c8017352b8dd8bbe4737dd8848a7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
175e72164d8b2cd318758911cc365c43

SHA1
f8e439e53fca926596bc3b94eade9f3c96e76446

SHA256
6bf10dd279801cfe223dad514f60507c6321e6bacfe93d4532febded528750bc

SHA512
fbefaf42bc065471fe44e494ea510a0faf87e7561d7eb7a6637202041289856a0b437f2874f88d8515f603b8f9e61d5b20fe8ed44f87d6050ecc8fb77154fb2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8723924490246dc21780c1cfd3e8b7ab

SHA1
8cc57392130c1338ce15987da9d8710561e09d7d

SHA256
e1e5a9850dbee6cf992258824032da2d430414d32b4aaa5e94b66e29863d7bc1

SHA512
8199adfa41b67c9a5ed4fc1b385b22824040f9379312d68325d12d18d51b72c876fae29c9b47ae4c2727ffaeaa0ee5228950e0784ce9df5e4de1af8c264d0292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2040b65cabd9edcf5f8132f456992d8c

SHA1
b20a4102b025645c8fb9d70ef3cce8f46510afab

SHA256
754adc862f4016e796fac59a8ceebcfd5e0d4f7337ddc80063701c11d6379951

SHA512
3e449c74f1cf189ecab7eb6be3b7e476114f08f6d2a73af984398a6d0ad57b2ec30fca462a15d43fcc3ab364e2d8eac9a70043f03c226e2752e8a228609fb893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a8eaf5c947296c1e006f9a3f1f84e994

SHA1
9e48dcee874cf12741d2ce3a20572d560e9e45c7

SHA256
103ace8aba6424c9b408fe5d2a94357021b620c24147bf1fcef684ff69ee692a

SHA512
2bdd3e8da078e7b3796121aab4bceac6f135dff8cfca17269719bf5ab15e6a13b2bc43c1f1d2333c2494010882c1081fee38b8eb8bdcbde6e90822c5be03a3b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d93e3132425e76e8ad5912d6def26359

SHA1
b150ee36798a0b26d52ab2d554b2c5a9883c9b03

SHA256
6da922c024b772ec0f2b68690bed1c6d259cc5241ca0ea3f26d7211f6f9b2271

SHA512
645e2472b0d8a2b44ecfbde7bf096bfcf483eb084d5914fb1a58b359248ebaf8d72baf1434ff51c367f82e659bef22fbf940d0574728f30e420e012402f839c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9a73ccebbf05cff7d06ec238a7b3c682

SHA1
657b65f02e40b751e063a39ce047878d6172eb5f

SHA256
11d1e872a8bd00b575ec846b212f6a414a0098de24740bb54f63a1e05ed3dec5

SHA512
d23f9cc230b1ccb863ed878b14be42b2bc92ddf7507f5e0734ae327f8750f781e0ba6133b99896dbe408e5bad4c2a334ab3f9a30ea847173508cb4232ae31188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ecb04421a4fa80ed985f6de7bc91f8b8

SHA1
7af0f324cf11dc3d94909855caeabe18b81be271

SHA256
a4d7f8ff42312b7afa2354478e4ee1681421bf03db55566128155ebc812d8a87

SHA512
290aa20d8027894ed05809f2fa042ad92fb08262d1e319232000de9a3df6c66d4339797e3a1fe2c2f83660c00a02b466249da607d66441ecfe38ae60826ed537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
25e7e550760c32d48d797131d048aa91

SHA1
d115343ac41932cd1ab59653195e3fe48f513218

SHA256
b2e70a3d9fb96e09b4db44864e3d5c6791631dce733e231a8d0c69b7f8af82a7

SHA512
0cdba672340bf51b12665740f3c5a6b3e44b69a33c37aef8d2e453c24cf3de11daccb925037a2def820d18c0955a3b34b1037aa8d90c332c8ce930f3d12658d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
699cb0b1f63d73e9c7bfc74fc293c03b

SHA1
82ba92d621778c960b1ef1bc4b5e66161823495d

SHA256
8f3bc66e1ce523aeaf8a55d0ee18020e91828ba622f117bb07c2819a8d94ad5f

SHA512
bae5a39cd7757b74e6c65c9ce51e23f391fcbee3fd46c19380eec75c482aa25d267d7fef1389d91dc74430d110f635459524b25503268d128499652b445cfbb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4dc4c472f2af4219d4afc8addd3e2bc1

SHA1
8ee926ba0c21a0e4f2a820a6fab76db507b4abcc

SHA256
2d53da8b1f4f4ff8a413e2b077eaeaef70b199ce680ad0c972279ea4a4c76754

SHA512
837e11405485cb0998f870ace29f7fc6375ca57a6cc1f126b169aaa4d92d46f2f06422153edee49f5212ded02def660e9d908bf32dae52a26574a819a3f186ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d551.TMP

Filesize
537B

MD5
733ebf939388858629043e7bd63a2d84

SHA1
498c230afb75308f66102c0c148d7a2876d84790

SHA256
35c45d852b7a08ff1574677bc41b3264b412dfc4af73c82c75e86d0661c4384c

SHA512
c6174549c0b6dba20610e90fc8a68d0a5d67fcd41d678623597288dbc98219c2e465544602bfc137b6901f54c6698151f51c8a5eba6dba32951f500921626fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3fe39a2c6d9a1fd509244c941b8b5dc4

SHA1
ead4d6b0d066f0ada744cbfa8756127560cee11d

SHA256
754913241372f2eb4ede21f902d63755640e8388b820cda5d46c7f625452eb06

SHA512
741ea68328e61b0c56c0e0fdc6ea3ff94c8333880b91c1f9508c62be410db696456c4bceafb8935f4ffdd8e322efa96f234f10f733ae60b549dd9344081321fe

Download Submit