hxxps://terabox[.]app/s/1tC7m6vNwWaQ6KV90FoXCpQ

Analysis

max time kernel
1680s
max time network
1687s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
15-07-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://terabox.app/s/1tC7m6vNwWaQ6KV90FoXCpQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
752	msedge.exe
752	msedge.exe
4296	identity_helper.exe
4296	identity_helper.exe
1784	msedge.exe
1784	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 4004	752	msedge.exe	81
PID 752 wrote to memory of 4004	752	msedge.exe	81
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 3504	752	msedge.exe	82
PID 752 wrote to memory of 4412	752	msedge.exe	83
PID 752 wrote to memory of 4412	752	msedge.exe	83
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84
PID 752 wrote to memory of 1692	752	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://terabox.app/s/1tC7m6vNwWaQ6KV90FoXCpQ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffc043c3cb8,0x7ffc043c3cc8,0x7ffc043c3cd8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,17357070639086541515,4697832109629162525,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1ff2a88b65e524450bf7c721960d7db

SHA1
382c798fcd7782c424d93262d79e625fcb5f84aa

SHA256
2d12365f3666f6e398456f0c441317bc8ad3e7b089feacc14756e2ae87379409

SHA512
f19c08edf1416435a7628064d85f89c643c248d0979ece629b882f600956f0d8cd93efbe253fa3ec61ad205233a8804807600f845e53e5ed8949290b80fe42d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
562b59fd3a3527ef4e850775b15d0836

SHA1
ffd14d901f78138fc2eece97c5e258b251bc6752

SHA256
0a64863cb40f9d3b13a7b768b62e8b4707dfee1d3e86a07e999acb87bd7d3430

SHA512
ef9fd3d83ab85b18cf0e0d17e2c7d71936f783e3ae38005e5c78742560332f88be7c4c936d4dc4179e93fde0240d2882d71ef7038289c8cbddbfc4790c0603c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\067a044d-0e3d-4f0e-a418-cd99b7b9e403.tmp

Filesize
1KB

MD5
16883125bc03e03d85c327fc045589ca

SHA1
df018bcacbb50232ac0ce4fdcca261fd83622da8

SHA256
8c9bb2f2f8253d5f0cefbee69e0e9542bcd63c8ace06bedaecfaf7bcb78bf753

SHA512
01894924683ad4c5d12ca8c5c2a0763f6bd20891dc7ba1142db34ff70ea23116bee63073a89f4e6b2e167e7eceebcf12bdf834a1ca31ef3743005a0b6451af3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b7

Filesize
143KB

MD5
9794e3498c913861b5925e7359cdb201

SHA1
9063bf26eb7c55f5803727f87a3e363f864a19e4

SHA256
e20fc86161625a34a7bb440dc5b72dae3888f133ac90ae9fb3f652998ffce9bb

SHA512
6c076acfb615b57b1ce3c363ae8db704d748e27c8a9fbcd447d1bd45d0448db497a4e3e9bcdfc073ddce10563107c83f9a4331c6b4d1e86ca2d5ab76601d16a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000bf

Filesize
20KB

MD5
261fde3726e10ce16c8c064a911b063f

SHA1
aa00c171e26c3adfe81ce92ff0d69a9ae2221819

SHA256
752c5bddc58e3f7d6670d7c92c5731e627f963a7c44ff1c2e985129b5f4333f7

SHA512
1cee8c21fc32320d056f2cbd9300c72204907297000b3d3c5f2c1d1124e46db29d23d7d0e13a8fc1b1b4802f6c15bbb24c402439a4c106bb00d98dbe5ed3a9fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
963455da3bcf6c1950ea25ca8bf69494

SHA1
a473d1d046c5cced9802d1f5c52db7beaa938eaf

SHA256
f7c8a14881bd4779354cf8c89cca3407b6482b344ba7868328e4239ca05eadd6

SHA512
73006cdedfe13d802d539344aa16ec75c01343f0b7bbecdaad2e3ae4094180a37f947bd67351178d1f1ebbf58788bc6ca571155ebde6b64f88ea48223b4b80af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b49bc814c4b0ab988cfcd43574f81f46

SHA1
b3ec964912cb07398142dc8e25197fc31fba3918

SHA256
bde29aa748fc43bf769713015bca86d446336ee15cefa9e9817a835fb6bcdc53

SHA512
24f0bc549a8554d3b433ac3db65d72997e6e9d3e1012adafe29ef1613e125e1441458c5a8e5c25a2792e26fa9a588bdac31312b275bdd13f2eafb80a396eaecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8955a89f0f3ee29e9f41b56dd641858c

SHA1
e5f771f6e1c253b7b028e667b076341808cb1a8a

SHA256
8ab9a95070293f853eb30e8294ae67a145f738aa9a41fb85ff36c63be6292ee4

SHA512
7a5b542f1bae679cb4830eb9da826e524ef92aeaf26ce89ebfa30b5be8deed6d541ab6d4cd7f03769a56e92691bf38b80b8758a40edeb997482496e5496c292c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8928ddb3794e130ae415e783732573e

SHA1
55518ce34765b0668e6c9972f2426706d291d7f4

SHA256
447620132fe5aa5c84794a46af4a2a22df8c0bd58056278db3d9ad378fc88772

SHA512
4ee6c76e15fc775f9e1f79bbcaf3e1e5f5f68d06d0e8598353e0e24779d9f1d5dd2e603dac0a6dd9d0bbf71e3476a500b5e54307149eee059847e9185d42d8f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0fbdd25f0cf63c6c5fc66d4a930aefeb

SHA1
269d6c4a3c011d2d2b0f94d1dcd27dddc5f31bdb

SHA256
f2b7713d5b59e5114eeeeeeae856442fb2d623166392c86de69d1b914f046e40

SHA512
e82ef02d143b0e9d41925885cdb180509d450066a973812921b963cb2ae7f938eea864b2eaa6b8b6d56c5340b3b92b60c396a08207f4066178272bd794f23db5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9dc7554b08dd9f899609d79943acd12b

SHA1
9f9faf8c8a5569d112e26dc959220d86af1a750e

SHA256
96a2f36525620cd8f69b101f9a683c4d4e0c514c69092030590b990c699a64e6

SHA512
a4f2f8adc025000cbaf56ad06f9e9b99ec4d62890fd4287a2bd553e7fd70f82ca447eaf24501112a32254c581b73ddab0911bc7e708a63a0a70f4361d9d805f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
865B

MD5
cfc6437b7dc24e580c7c756f999203c6

SHA1
d5c9e67ed44eb77c501a391d40d7e0871df9f915

SHA256
b9039c234e5a3d6a86bbee38786617dcc6962f2d272f2ed179946ba66319ccba

SHA512
04feedd912f062ca095b7a71ddcff094a0ee77060567e20d4e03fabd46639d58f3a98b12f8006e75f4a26c0002891217015fc52b4d648cba7a181128d5daf22f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583f65.TMP

Filesize
699B

MD5
696b4f545f5d26cf8fe44a7d2c2b6c2a

SHA1
fbc19bb2d73484e62e7ea0828e5c3b4a31bb4151

SHA256
6090d3cc3f0dbbb23d991f8fdd103ab2d76db20a6c4f453197f0274c86f2510c

SHA512
caeae76921d813ab5581723ac7eb529c4c0b919450ac47c8069fa71318c19484afa98f5dbe1c86e19c68dc7e54a1cf12bc9bea8fe81029258444a8bb7aeb9de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000001.dbtmp

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e34e409bc5f65c8f480d556188773720

SHA1
68779fbaa21764359158f102f208db26ada88174

SHA256
2edba29cbad018c1d55f78b359b3d12f09188ef3ce5df5664c42381c20dbb663

SHA512
dfd6ad724878d5808d138c759429fcd36ceab80ddb0c9464990de6c121e86d93c21601ca6c1a8495b2007a63d81adc19c03b28171f7a9cedad7bd73fb988a77d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7a950a3fda8cc64d941605c2c9f914a

SHA1
e9aaa2cde4f1d5d70239d1810bc758b9030e0faf

SHA256
b06232f9934f8796d25b04d26ab6a7103659a43a3dda947976b7b80ecabb3731

SHA512
697fdf5776af6fcfe1ebeafb6d3a3b17cb82aaf75e76f4f1829cb07bd3a68e6322be6ae0c589f094797df692fc72fb947a4a82dfd8060bba85d70d49bcffe30e

Download Submit