hxxps://r[.]oblox[.]hk[.]com/users/6811659190/profile

Analysis

max time kernel
90s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://r.oblox.hk.com/users/6811659190/profile

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1479699283-3000499823-2337359760-1000\{C682582A-E7DD-4AF0-988B-3C8E40CA348A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
3704	msedge.exe
3704	msedge.exe
1684	identity_helper.exe
1684	identity_helper.exe
5924	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 5072	3704	msedge.exe	84
PID 3704 wrote to memory of 5072	3704	msedge.exe	84
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2604	3704	msedge.exe	86
PID 3704 wrote to memory of 2764	3704	msedge.exe	87
PID 3704 wrote to memory of 2764	3704	msedge.exe	87
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88
PID 3704 wrote to memory of 4468	3704	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://r.oblox.hk.com/users/6811659190/profile
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff965cb46f8,0x7ff965cb4708,0x7ff965cb4718
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,15143173406847757882,17007477996709859569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:5480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6738f4e2490ee5070d850bf03bf3efa5

SHA1
fbc49d2dd145369e8861532e6ebf0bd56a0fe67c

SHA256
ca80bbae3c392e46d730a53d0ee4cfecbbe45c264ad3b3c7ee287252c21eaeab

SHA512
2939edf5e6c34c9ea669a129a4a5a410fbbd29cd504dc8e007e9b3b3c7fbb9bea8c14d6177ac375d0c481995774a02d210328569231cb01db07b59452333b22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
93be3a1bf9c257eaf83babf49b0b5e01

SHA1
d55c01e95c2e6a87a5ece8cc1d466cc98a520e2a

SHA256
8786fd66f4602e6ed3fa5248bd597b3f362ffa458f85207eaa154beb55522348

SHA512
885b09dd3072921f375eedb5f0575561adc89700ecfbe999bc3e5ea1d7cb45e19d85c5e420f2c0a12b428742e1110e66f4ceecbe5a6badddd36cc9e0aff48e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
efd352344023c5afc6db14a4c7543c15

SHA1
6ad53656cfd0c4c5845234109215789164c4c877

SHA256
e7a017029cd607a93a30e79eab9b01e339443efa45c2cf93c0602e6987d7c711

SHA512
9e3609328b909ccff4e9b027853b8ad35839e1987ac56acbda6b8e26ab661f6c18326ce47f9aa1316c9f95cea9b7aeb3343efdf038987aa800ba5b755f609b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cd568427366d95c86c4567b246a0eadc

SHA1
e66a8a19ce2b63ff8ce21b78c3d325e4fc325a84

SHA256
10903c0ffe82b71068f6eafd0509c535cff2daadbe3561ae6110cadfb560383e

SHA512
ed1ed7c48b33a655771706ba1025fbae4d6a0bb6a62d8348c90a0de8a235b590c53e48d316f42ba8082dd8b1c2795f2d8006d52a6184d959604cb0114868fd52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
436b56c24fb49bcfb0d19e406e23ac85

SHA1
41a9e9113f18ce057d3df666a9b52641a86d3089

SHA256
cdc591e70b47e6114a67889b60fcafaf28c17446c79f3e856fcf40422530dd1b

SHA512
4d0b9c03304b774814048b413718677758c798f7e47c9dd4b857701fd220372bf10a89b8d701328a9ba945fbf1633f4832bcd76e6592bf8c84082905d0b4c622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1ba393ae164f2de91d200321b02e7603

SHA1
613bdbd414fac0c06e0969218429635527c9c88a

SHA256
7b30af3cf04a2f82380ae9d580c98965212be50fc144112a5304a7ed11a23836

SHA512
19955ea8f2232a140581097191aea286f122e3b450837bd659dce4427a001601a5586533a8209d6acd2e30955d5abb8d60dfb3c3deb08f1d497fa7014758c41a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
84f4120e3d532ff1f0eb4e54f7d2c2d4

SHA1
4ce29f59e2b551c8a123c1b0a1ff5230979eaeaa

SHA256
be8bd3a086d2c537a6b63ece9aee44b876dc33b81a2fc4dc6a0fa7d08faf729a

SHA512
234fde5381cd9b543cb50ec27eec51a0fbc9a07f95d3fd11380b007fdd123b84393433a313ac0a8e39f879e2c364e8b34d8c90d9d41cb54f7a2433d47e850921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f666.TMP

Filesize
48B

MD5
f821180816e12458bd21d53f8b78546b

SHA1
6559ec118ccefde1b5b1f9c0416f812c9cdbc8e8

SHA256
f0589acb8c54e396c01ba85580b62c147033b07622aa312e3a4afd39878359b0

SHA512
f436f23230e2dc950c6707fae0f566bcf949af69a408358cbff487b282dac07b3fb42bcb8c2298f8a6438ab1db5b2b19403c4e51278eb359ba6d73d2e0454ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
398b202fa450c9caed11a43c9ed675ec

SHA1
1cbfbfff4c7266d627751859fef110270885f474

SHA256
ff061fad832d41ee28c00bfd1eaa19cf7fe7e100583afb2c47dc5a9a9507ce8f

SHA512
b4b547b25b966237dc32059aa4a916c995a501ba44de274d2d44711924fc467019c17a898aeded7a591472bcbdfb71798e327d617352f1dabcc9cd430860e877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ba37347f33659c97f81b913a91ce3b42

SHA1
a3a3efb27b9e057f6e7e75e39c65acfc5923155a

SHA256
dff32dd7ee15d7fbe79d44d49096df716c14be15574d78c2539c3b7b377180ca

SHA512
095e5ef19816a7f177cf60d6bd0c8938d0b2c9643fe4520d79fe453b64c5616b79a9300364d340ddd3be307b300513db256bc554adbc355ce288b84e611109f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2d4f4c49d3d696fde7354cf0bb23f21b

SHA1
9d41deb86b41af03c87ca6318e728f88097777b6

SHA256
616864c20002e1e897e711b0c4e0377266b986e6c939bd3be5e0d54ce6b18ec9

SHA512
fcf4173106ecb0ddddfd3076d276bddf93737f326e804d4ecf349db65400c236b7d643fbe8fae90c418431877f06e2e30b5e86bddfa9d94f133f394b02689858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6d1cc87f95d3449a05b7cad6f2991219

SHA1
c7142da1d7ac8f740db1741627cd205ea02eb9f5

SHA256
c7d849602212a162aca3e0c815a04d89bcb425862cc660d2fd5e23b519d583da

SHA512
95546d6bbd1476b32259611373bd1b970adc3d8f8697d04d917795e05cd5bef72b633f0f683baa70aac9c32dec321a804564ac7b1bc88d2f3e5d2eb77dcb10c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f4ef.TMP

Filesize
2KB

MD5
08a8b6758390da2b3a2a487da53077c4

SHA1
31ef101df8d1fcfdeccfa0efb414d4b64f240b38

SHA256
3f2b254e2131756d37e30a8625b5a43f4cf134bf52399c06374e07cb035dacbf

SHA512
6951efa0d60f0f2e57cfa8367be7b78c7494e869e5fd9040fcacea9c3d241cffd2e9947dfbfa362c232cd0289703e89d38f9779af3bcf0ae279d666deedaf080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a038e933045a40d20cbe952071afe237

SHA1
15229299d485481476d0e17211e0b8937d96b96f

SHA256
bc3dc9710fbb814835073c70a22c20ac74677788d75368e4fc58d62c70706473

SHA512
2e00deaa726b0da7b4d726a2080e2d8a2f01260749d63f1a9621c9441ed9ba251b57684aa825b743eeefecd87eb3c5d3ef34aa3dc97f00fd2ac43856ab3980f6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit