hxxps://a2n[.]co[.]za/license[.]html?white=bWFyY3VzLmJhdXJAYm9jYXIuY29t

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 21:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://a2n.co.za/license.html?white=bWFyY3VzLmJhdXJAYm9jYXIuY29t

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	api.ipify.org
40	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
2880	msedge.exe
2880	msedge.exe
1180	identity_helper.exe
1180	identity_helper.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 220	2880	msedge.exe	83
PID 2880 wrote to memory of 220	2880	msedge.exe	83
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 2788	2880	msedge.exe	84
PID 2880 wrote to memory of 628	2880	msedge.exe	85
PID 2880 wrote to memory of 628	2880	msedge.exe	85
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86
PID 2880 wrote to memory of 3224	2880	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://a2n.co.za/license.html?white=bWFyY3VzLmJhdXJAYm9jYXIuY29t
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16098829490832553614,3732110319406523011,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ec058a0f6fb216106f2ec46ec9d2a319

SHA1
a0b802396ad40716495eda2137b3f686692d2770

SHA256
259642b60eff042036d1a37818ff22907a48e2bb768b1d51bd0e74f067e3eab0

SHA512
8e5c79790cd69c67880c1fa3bdc673ab0558068107e0555eb72cdb6de1d0f64e5507dba863e538aaca37e47a71ebfaf0ec81afc7ff939889909e57845d8cabed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0bd785a15b85d9179d3608c933485ec6

SHA1
192c433f27d5b7b23a0e86f61d9d598359afc492

SHA256
257b55175951b49f14648881f81fbaaf1bb5ec7d18a7b129c74d856c503de577

SHA512
4efb6ddf77f31f7e53b9d464b7c053bf7bc4e318d6e1a64b8cf239935731c30bf30413215c6ed04876cd3caf762f03244661f5f3f86b3cbc80efe4e70ec4cdf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d10c7c576898bee0eda70ab1934b14b

SHA1
6d9da6cce8fd54c8d0b389df169951928c1eb75f

SHA256
da258c330f7aaedf49c146c512c354e3a8aa5a7304035104552e0bcd1e60473b

SHA512
30df8a0acc98bae2f0e49807adf3c2b03999f7340edfa827dccd37f658fa3241941360174726888ef81181a8e247fcb82afd69dbc3a584d966d0beac8ef1cf3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c719ec1d5209f46c51371847024a99b3

SHA1
817a397c192161ed4df3df64a4db06075f37c997

SHA256
84fe6e447dc174460e4727b7e3ba4c242babbb7ad3b9a41c27aec2d92855b70c

SHA512
ecd071d660abfcf4d49e756a03eaea71805270d6524235e68995b67b5712ec798a97749ae5c6cfe019571ba4f017d4c61021a57a24d5dbcdfa4aba9ed6b22c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
65e90d61251601eaae3465b4b31f3a3e

SHA1
0fe3fc4841a11851827d3b94b4637e62146fe886

SHA256
9bcccc9f3ef2017b5bcd2c52778d1583dd4b5822a20ef6f9bbf311aee8172ebf

SHA512
8bf0f07dfe81d7f2168a56a61464d9be5425b813f9da76382f8f5c7105bdb605f0176f3f756e879e20480d50a1ee5debaad3a8f47d4cb7136a754476e9748be9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
36dbbf3b8f0e0b20968e4c20a13fc98e

SHA1
4fc811e1074d66bbadad229f4cf352f302132dae

SHA256
13b1db14f56636a14d92539f9432efdbf2c702bf29a479dedd4dac94f12c9fb5

SHA512
5ffd3a8943cf5a4a5df2dc8dffbc1d2dfdb40b31038ac357e2eb7df21a860f040724f1d20b9aea88e273c4e179d2c0c0de1585cd5fd4697d51fb64191ed9d5bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
af909faac2c33f5d599a71e9e7720a96

SHA1
b825575615e0aa2d53ee3e5b74a2cc0bbce9200c

SHA256
35d3e7e4cbf796b99e641ad16a6a3d32529acda0dbe6dd5891c43de200e62e8e

SHA512
4a819f3c362e388f58ca3b65acecfed9cb3d332c57743746f6bef0160b36c935464cc4d264111d9173d6bab1fb7c009561a371bdd050d4fc7beed8e0e3bde35e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bc3b.TMP

Filesize
203B

MD5
ebb15e5c9f7e3a41dcc1fcadc4d61e99

SHA1
1231e1ff0e844c8e2c885ca9bbc517054c26d072

SHA256
b5635a92b259c9934c3ea0e48369afc27f603b7868f4e2666bc7c09677d1f108

SHA512
f3fc9b4e7e5f381d6bad007b958713cd50393a04a1dfc819e2117fa5fc810e13b9dc7dfb2d1a62374805f230f02ada09599554e29d3a26378ad078b57b7f7f3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
552e6963bd3c6bea5100a0ef084c116c

SHA1
cd98701c97a39ddce7d6c3dff7268ffddfa022b4

SHA256
8100cea668814b4d07620f9d617da0aeb50e8bb47997f9470093742d27f03be1

SHA512
0aa646cd52a95e308406d782714f384be26263602bc5affab630a195d7939de4d10004dabb9c72a408ca9f7c7e3032e2ee6a7ef410dc9d54f4b68ef5bb7eca08

Download Submit