hxxps://www[.]dropbox[.]com/l/scl/AACGbZoG96dqDkbFx73347yCRAR4sN9O6co

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/l/scl/AACGbZoG96dqDkbFx73347yCRAR4sN9O6co

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
2200	msedge.exe
2200	msedge.exe
4476	msedge.exe
4728	identity_helper.exe
4728	identity_helper.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 3952	2200	msedge.exe	82
PID 2200 wrote to memory of 3952	2200	msedge.exe	82
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4384	2200	msedge.exe	83
PID 2200 wrote to memory of 4444	2200	msedge.exe	84
PID 2200 wrote to memory of 4444	2200	msedge.exe	84
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85
PID 2200 wrote to memory of 4788	2200	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.dropbox.com/l/scl/AACGbZoG96dqDkbFx73347yCRAR4sN9O6co
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa380546f8,0x7ffa38054708,0x7ffa38054718
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8371511184796633023,17042135193653274122,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5804 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
798475e5ade811ed49bc94cc703250f7

SHA1
a6322d6945353727990598510515eb1e34f7ca0e

SHA256
8c973f75c05708f480e647552ed2c131946eb28b13e5c0b9978d1921ae4d6997

SHA512
d90faab9a7bd0ec5bc0238c2a1c23527cc6720a0debcc598e6ee296e835769855d8537c1cb2489745a1370770961606b2f385f3f48333bc510c3508a83cf3165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
09db74b2b3eb960882d3dfb49637c022

SHA1
aa2deabe1e583dd429ab3d650e2ae39ee00eda70

SHA256
0c97bec4b85ea03ebad1ce95e384abe2dc13613249ce720d90617e0f672eb5b5

SHA512
ea65d506287415e4bb0a0f90db1ea4f879a57303c323cc5449a4a6ff71bd09423df14ef98ece6268863965ad4d2727cdbbd361868691ddb71105479f8e6298f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58f4362c9247969356209c7fa3e27841

SHA1
039497bc5ec0cb89903fc052d3374e68faba7bfd

SHA256
b02c91b295345ae2af789a763dee7249807874ed4ad647438c103563d3a92099

SHA512
1e4e31b39556adf293964b6d9be23d1754832e1295b48c014a597c54006504dacc3daf85ea11144ce9b87cd1293b920cf5e7299a5e32e0c08d94f58a7b701a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1fea824a5dbb2e0b847e6f8fdbc8a5e4

SHA1
d68aed74ab3ca9d5ea0e86a0854e1b613a734193

SHA256
88f38ec3de7e39969a7da299915aa946c66b98683999d826d9efa03810a3713b

SHA512
c0d0abf24db6702975ac432a65b39243d3ae369fd9e4994976022a811b083a75da64889e2c662b372cefc7454d42ba48a968345f58691663c684da23c3c9c03d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
bc495e6c8e394a7de65089aa22187b09

SHA1
cc2b01dee07e36fcdddb1ac5688e099dde7f5b0d

SHA256
b4c64bb76ffe794a428bc881cf4ae7a8b6c09fddf62c31a074ad3d7906e141bb

SHA512
da94c5bceaeb45b59a94e80faacc8fa1bc07f3d80e1cdfda44da10bf4a8f1919cc258147a9b8d8190ca12d38320e20b7ef1188845cc08a02e88e619c9e4a58ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
7a3c499f97114d3e2f8178fe4faa3aac

SHA1
5a2fc056459e2c6aead1ba4d2aead7a88ca76463

SHA256
f932c07976093f8fc6e97eb5499b8177084bba7edf1f78bae4173a88d3987c18

SHA512
4314efd0c2563a70d0efbd330c83c79e41db95092437050cf34e477ebb86fb5e7a9c2b02996e7253f0ec007ea34406ff19b7ac41bdfe26172b12b348eeba7a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
809eaef638d6ac75ebc470d0c7cea121

SHA1
1367b99b23d28298225d82423541b8e24f321b14

SHA256
d4b8c4bef410f83e3247b9da56e91c2aff255ea80ca9e516686888f3eee0a9cd

SHA512
2c8fbc0425d16a4d7b186e51e54a964cc1c27e793a6929d4e6d4d055f4c4bb8a6e76eb8bd06248bcc00a140591928e680587e96f98a8e525d5010f8e4edd353e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
a617f784151b8c67027ba6d5afd0581a

SHA1
a3b5ef51543372c632a2be7b12a0dfd9b47cc66a

SHA256
caf4569561945a63f290f301c21bad5ff186372f6c0f67c461f3efac6c5f0141

SHA512
8742cc080f2b45e23bde0360c52073fea114fec58a9f9141bd26cd493db375215fb30ed8176123c5f1aaf1775408398aecaa6d43dee1eeffc4aef9246072d294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
3813b84a7a5d9c319767f4b7be152c84

SHA1
c5e98c7b0e512c4e97e645ae968e2fe2784d2514

SHA256
75a9ee2e84a9b495f1542cd9c047fcb2692bebd3e5298b7c43da50d126d9a02b

SHA512
433b0226cff7c4646da4f5b1a637dc094a41e1ec4286fd2413e979201f22d690e2de3e76d4df4989cec1a704836e1577f43947d491926a6bade3f0dda35331fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
3f352569495e8fac5e5a118b43f5c6d0

SHA1
b8224524cc5a68388e881c1e898e4ae70b7bc6c3

SHA256
d520fb86b12c392a491ebbd27983a8092916b8c3a42cafcb6448ae5ae5a9c236

SHA512
d877a301e4fda0cc76885db9796da9218af38544498602b5cc69d381e8a7cb54122e7fa8fea2eb8905ee3559a19d31f734e20470d225ac69ef444343f4ddfb83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
101d160416363b50a6cf7987dbe8e0a7

SHA1
bcd42af388b3466ada1f5151d70c71660d8e3f08

SHA256
2b966a023d3bf15d5174fbbb2354871ef0e95578299607e750b825a203abb7d7

SHA512
0667b0d7075e7015c218b3956108c846d72e4b0b14ce9f2ee093103f60cf90f5358d505bada97f9978f828c6fb3b8bf83c78fcbd61eb74da296f0ebe5f5448e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fa8c.TMP

Filesize
369B

MD5
064d556090b379f71b8de68f609d178a

SHA1
34af5f13d52a88b9b2bbab8d30aae65e32777858

SHA256
a3cb5d1b6fd8f85b6e5be6bd6c27b37fb701f3cad57868ec741dee8ab01aa8ae

SHA512
bf86bbdcbe99fe10c9da993a137dc82acde3395104a199086b43e3761b962f3a6a4bcdd56ac71ece943fc172fc6d4245deab00f986e79347ddf6fb901a0c7a3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2d8f733e2dced2b47badc5f7d22d3ec9

SHA1
74e63aa640746d26fa34b477ef7abd8e1de83966

SHA256
1c0b6125e765eeb40b14bca01df0074df935a61ad4baa24d5de959091031107a

SHA512
d11f853d2400f109b6352bf1a4bfe90df3479284886b988a9c4944ba20c04a55dc3419a17be54f5cd167542e2cfa1ec4a5f448b9645635c66edf82d392581b3c

Download Submit