b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663

Resubmissions

04-08-2023 09:55

230804-lx95zaad82 10

24-07-2023 06:21

230724-g4d9nabb5x 10

03-05-2023 12:21

230503-pjk6gage31 10

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2023 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe
Size

553KB
MD5

09f041a556aaff79bd410a08ba452a86
SHA1

fbb16877fa1eab06e207177c7c9d581e60575390
SHA256

b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663
SHA512

4f4376e30572a306fc884d033b452dd6f8124de56139d7bdad83252b1862b0c323e4a9c74ac0fd5949a3800c8d4b177f668c3be179579704d7de6cfa4723e908
SSDEEP

12288:XZWETxtYn0CtMjoUexjrTadcWBbfoz9N8SCcI7NUqIFzGRIF6nj1K20XdD/S8Ch7:XZWEfYnDMjjQjCdx5ojI

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
3464	msedge.exe
3464	msedge.exe
2400	identity_helper.exe
2400	identity_helper.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3464	4080	b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe	85
PID 4080 wrote to memory of 3464	4080	b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe	85
PID 3464 wrote to memory of 4520	3464	msedge.exe	86
PID 3464 wrote to memory of 4520	3464	msedge.exe	86
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 2020	3464	msedge.exe	87
PID 3464 wrote to memory of 1644	3464	msedge.exe	88
PID 3464 wrote to memory of 1644	3464	msedge.exe	88
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89
PID 3464 wrote to memory of 2720	3464	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe
"C:\Users\Admin\AppData\Local\Temp\b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7b9946f8,0x7fff7b994708,0x7fff7b994718
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13302115965463585297,15542416853351573041,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3220 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b67352f2a18830c9ce765ac22256d1e0c1d5fe94bf564720dac661827e73d663.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7b9946f8,0x7fff7b994708,0x7fff7b994718
    3⤵
    PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
60c11a3535241abb831c6967ca66f9f2

SHA1
d7659f8f98faff975e22b526ce99b96ebc24b870

SHA256
1dcebdb80be4a1352470bfc7e04cfb5bcaeab146ac97714c1014ccc739cee1a9

SHA512
e16538c5d24bc9f34680b4d1cbbd873eb1a84c0119b39f484faba2a6868a58195c74c91ae70621ec4d19ddb8040b35691a5ba86181d18847f52b725465e971cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b59d7862a7f4c8aba1e5028755a0585

SHA1
1dbc87e15783a5e0f3075ae0a3300dce931768f3

SHA256
a1cb1ef18ca111de18c70d301f8e666d6fc7c4bfc65b4d39bb57d189f41d0066

SHA512
ff8ebbdfbea62f71a294bcca04370ced74c93f4a44f09b8c8b157c3042c08618c84c1a0e82d83236d4595ed837a3cd4ef18b5871a9900140979cfd920569ed74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fa95011419d04bf5ad86b763e0fcae6f

SHA1
bde8336fb01330cfb69271539290346cb1ecfa4c

SHA256
e51b9eecf3f2562585261156524fcfa2007a666512f35fd346f08b6c61326d9e

SHA512
244538d3d8c792ccde84ba0a0a9f66099ae94a88f42dd0fb09dad432085cd8f4e5f2910cd10f0e2db616728c03bfecf36453d63d091137e5441f9ff15e4fe62f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
0b5fda4f36711faa3e13c50a53a4df67

SHA1
27a5535b6d602c85bd4fa478a1830a9de00474b3

SHA256
c463667f5a2811a59142d0ef65b7fa3b4504c68b48291369a8d93edffe8f64f8

SHA512
8f4ad0c2f32700443e42bc93275c6972b58dbdd8a9ed0c27779c3a4faaa4e104afc57ea84669dc84455d456241cbba4a623f6ae3702f17f47c9aea3dcf05fe76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ff8e.TMP

Filesize
371B

MD5
db76b49d10850d365357043e2285ac04

SHA1
5f99067012a68c3aa84bc3a2e550d76bb2894e4e

SHA256
2bab4b619d0e124a7e74d45a27015558ca08def55a2f7f88e9217ff6edad95bc

SHA512
cf81e8f9dc7802d79d270ec3bf7695f2d681a2ae6d897f4ab61efa23d4d9aff12023019ee29f301e5c10c6af0c4dd165856b41f41187d9b6f52bc3d3b40e6ce7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8c84640-89c6-406a-b524-d67a522e27cd.tmp

Filesize
5KB

MD5
366490c679cefba48abaf73bf1d43d9e

SHA1
6407402df304348100c5afa22225ac43b0dd1486

SHA256
bea037c1c22e0bcb9dc856839dbaf2bea4a8a8629a7819a5eefd1f88fa1d2d1f

SHA512
18eabdc89ed2ce22a072d2f367b8ccef36a377b479ba8440626443535dbe6a9aef940c06509a06828d3beac409f6cdbcf10a92ef3dad6b2805f0886d13e78215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cc77d74bd74dba014096456dfc765219

SHA1
c418e920d1b3b72cfb602baa190b4c4ac236bb21

SHA256
c9c020320d7ef3fc7cfe4b2c1d3c41e4d9f3a9aa56adeaac81b3a27ed1dc444c

SHA512
0358fd0808465db6303e992cad8337ed85ae9281035082030210f83601d9f22385a428a7319b9ea860e22192f740ad29dd7ae4cb839a6963458f85330a832ebf

Download Submit