hxxps://www[.]dropbox[.]com/l/scl/AADVnKFU63sacbCbJBrffuecq46lkkURmGw

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 14:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/l/scl/AADVnKFU63sacbCbJBrffuecq46lkkURmGw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
3416	msedge.exe
3416	msedge.exe
3448	msedge.exe
4772	identity_helper.exe
4772	identity_helper.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4976	3416	msedge.exe	83
PID 3416 wrote to memory of 4976	3416	msedge.exe	83
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 3428	3416	msedge.exe	84
PID 3416 wrote to memory of 5012	3416	msedge.exe	85
PID 3416 wrote to memory of 5012	3416	msedge.exe	85
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86
PID 3416 wrote to memory of 5084	3416	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/l/scl/AADVnKFU63sacbCbJBrffuecq46lkkURmGw
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbda7c46f8,0x7ffbda7c4708,0x7ffbda7c4718
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8303153147547532012,16922814835675151790,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4829218222c8bedb9ffe89dffd37095

SHA1
aae577f33f413ec3d09f2e7ff5d9cc20a602241c

SHA256
49239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b

SHA512
03e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
15e9c4b4eefb3e1c08a010e748e10f58

SHA1
3172378f2c7a00553ce086dbf53fcf3126c5a724

SHA256
07b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000

SHA512
811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c24356d5c6d2b6ccb840046f0ece771b

SHA1
265a34c711d3b6d913f572eb2a763341219fad53

SHA256
89b06dfad9d33431e2be0db5933ec3d3ff409bee9d125a2a383564dc8d505d12

SHA512
04e25fdcc5aa2ba4a2eccae9f3d2c94eeea55aff0ec2b2e5e31145a601a123540a4c3d876adb64db9ef73723fc389ed7330a671602ea2b075fe76d75885c7745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2fe90fae488e281a2f7dc776e2babbdd

SHA1
859a2b08d961867729ec56005a23d564751b2ceb

SHA256
4bd0fd51039ba5eee7e1e4e83455c4654cba3ae597403de5c84f9dc2aa466bbf

SHA512
a43cd8fdb1db3a7f6d88b7f434602dcbbb03ab7ebcc89d2b37a0fca66c7fda7fee5cf27fe3069cbfb60d879256b2b4f55590b86d5e4323c37f879e61df405327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66e3f83042057eb10ba2fac332f77793

SHA1
ea4eafd32c2c366f5eb777ec97f45a27ff653ee0

SHA256
318ef2ca028d76974fe365e7e42eb5c4892e9f099510be7c99b5635e1f8e2482

SHA512
f912e20f7001cee177d8e85906ba1a4aa3fa5861aff848114acc62ef8d11a612ba4abf28d49b2cdf4b2a66db78b101cd676978747c9e1cbc79033f4a63072eb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
725ae4d6155302a5985b4da4696f44e3

SHA1
20fcbd90cec99c746ce20dc2286fee3a02c8da25

SHA256
62ffa96d9fe5a2066b91a68fc40aff0d07d23f6b037b80df57e6aa88ba344e2b

SHA512
c15b06c2a7ab352b0d6a329d7ba5350dc53288dc5c04e34a4316486632e2f3d3b75b2d0728c45b520549bd3e04b775215ff1f5edf91a8ee1403b873e60dd29b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
034609836f010e5a590e8840e25fbd11

SHA1
aa258319497a8b8051d41ade476c3caea5f6021e

SHA256
24dac21290bf1f750962be27f243b7566f7f0f212eec9bb532c3c80be73ba0a7

SHA512
de4b8589b3db4ec119556a385d8ba02d8d299c7605d709764c7461f59ce200aea97496e47e060c8095d8d819523404ec57e9fc9519c3ac0b428e83589367960d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7915ba0545666aa5833cf9f9f86d45d6

SHA1
743ecc319bc2a54973582d4a5198042a48fbe8db

SHA256
f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20

SHA512
a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
179acc8d92b7ea7ff2922d2551dece31

SHA1
0315347b146920f85ebf09cadddf0b4c1def5de2

SHA256
43f22b5824665a6ab6d0bf8ecc9d66c4116e6c295b4c920a28eb7f3bd9888fac

SHA512
aeb1d36718842605bd0f3e6890de33fa316c086af9642e903db896dd3708f511575c706b08ddd9a96c2236c9682d59bb2611db0fd115e4c07e92c996571ebaf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
9d09fe4e35368e3e8d49e7cd01ce1002

SHA1
90fb5d6955cc422f74f771cce28b40898866d317

SHA256
8c32981aeffc1b6d6d6cc3452835d12f1df00c19a92e6e5d3ced4fbff1756c46

SHA512
468bf62a93fc7ec9ad4f080febe0aa36f97cf9326ffff2d54515a5c8eb2613a77d827b5a9a62395311d4985498907f4fbefb6ac609950f51763fcdcb9f82824c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
46022965d7d16cd2a72066e630fb8b56

SHA1
a481baabb729c318e4e012a21ecc78c0b39d2a74

SHA256
f0df268da3fa10807f067248caee1839fe276205607605db7be6ea6ec2a92857

SHA512
a857dbcfe16b7811212d89916fb12843e82abe87ded59c09b68a62d8ca34e39e1226b755f9bfe0127b06b40569a8a20b39a7ba3845fe15f879fe4fac6979e850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
2f8456811da95b7a8085e48a2b273236

SHA1
3952ba32cf8a853bcff1d649dd28f1c4c4fd9b7d

SHA256
e81ae845b018d9c3b6262223b1d779ad68f44b3073967697e360f29c5339f9b7

SHA512
14d8db7a6bc849e2aaee46c8dd7988f25389656140cfac652466d03ecbfb94ba8b8db9199e9eb02de5984560e0d3ebe868b8c8ce6d60320427368f9cb5716460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d997.TMP

Filesize
371B

MD5
48c6a2192220ca5c6bbc7a2c5b285193

SHA1
aef8ea8b231bdebcfeafda87109fd704ef9b2f38

SHA256
c2b8dea5ba3560a12ebf42d2b533c413953667691016921541a6771e6edcad01

SHA512
bea43b95bde8fa114fd6465097644464dd61bd7c7b3bf9e950c79920af022cee38022ff5062ca8e6e0bb0a6f34275ac56d51536391679807d19b652622b38f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c1de66a8c263ea1f6eb4fcfd7d633dc

SHA1
acd7c2303268d9b094be8311293f65c3b60306ce

SHA256
732489710b94a845c3e8942735cc31bb2d3ab13238437b207778066a4d83196b

SHA512
30dbc6c2c4646636f01df3b8d5a68d457ccc7c47ba5dab7a6ee8314110024f164edd337adaec905d4bacef2eb0a35f56722874886887c0909b92ce1205dd54bd

Download Submit