hxxps://www[.]business-wissen[.]de/?id=6&token=31b498e308b7c3cacc0839e9adad1f29

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.business-wissen.de/?id=6&token=31b498e308b7c3cacc0839e9adad1f29

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
1132	msedge.exe
1132	msedge.exe
1732	identity_helper.exe
1732	identity_helper.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe
444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 3864	1132	msedge.exe	83
PID 1132 wrote to memory of 3864	1132	msedge.exe	83
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 1504	1132	msedge.exe	85
PID 1132 wrote to memory of 3084	1132	msedge.exe	84
PID 1132 wrote to memory of 3084	1132	msedge.exe	84
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86
PID 1132 wrote to memory of 3388	1132	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.business-wissen.de/?id=6&token=31b498e308b7c3cacc0839e9adad1f29
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6c7c46f8,0x7ffc6c7c4708,0x7ffc6c7c4718
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4077194517435584566,1863622116015444852,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
7d4a6f5dfe61fd4fcf33bba671c3bec8

SHA1
ef631a6fd7f927f97672b1bdc89418d49cda3699

SHA256
b14280e8713c4d67648f568872456a80c001a0967abc2f96fa9327eb851c9406

SHA512
a970b5df6ebe6eef9799980fe53b64277f17658154deeffaf56e13dfb170de0fa85264c7f6b8b0f449be4b7b6e2c8e1cc0f421e7862a2f62063ff658ab8271f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
caadf2ca7f64e5072c021f9d1c73f31d

SHA1
8858fb5a250662e82619dd57d4cf72c35a514ae1

SHA256
4c792a578a68e5f1311e3602ebeded650bd29edd81c80184525814db04791882

SHA512
84a797f2e2cca6c2b6229965f81a4ca89a44445723a911738ed8a7172868002a1d267b32522f130dbbbade3cb0435e2e9bb1d5a5da6fe04632effef9a7d276ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7aab5b8a81ebee7e8b796c4d0f2abba4

SHA1
f7f782cfbe14b5065d16604b70b03a19340ea385

SHA256
d76218de06324e4241b3b3cbbd60d1e385dafd27f1fb1daf59c38ff367bf0683

SHA512
7ba67ede57bf3f2148d01fe858e79eda3956c650fea30d40a8e97248ae64fb74cd689f886e013b4b25ccc3fc78502bcaca0df563ad5ac3017a479536835a09c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cce224a12ed341d2c462865e980b3391

SHA1
e2ba37ce3553ced9f78e4b63dccae09b2b366675

SHA256
4e0508a96255727aebce3a5a3d6613e3d3be3ae0b8731295bb23fd0a6cb1cdfd

SHA512
7ab472505ba308034796146f7bbd298f51d996e1dcf24b132a75a366cbbb075583baa110418be12e2639c34ab7e6cacbbff3b111b08a98cdba18244a2e953d90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
052fd7279ef7f2ab9625ddefc5d84597

SHA1
8cf697aa9bf49b3b68c67a273f22a55e5380eca1

SHA256
fc26a1373a411cd38eb16e8b957c28bed7e8f9134220ce52b00c2e12de2ac762

SHA512
be6106d2fa4db35fdd7d9a6f2220a0bbbc20d07d1d16ef5405d2d81ee16d6820588fa221ea49279a4d618df540d7fd1fa0c73adb7132ff80ed5ccc3d62947693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c6e5a3c2115431c22661311ea428c5bb

SHA1
1e737dfd4e0cf05b8b460f81a553978852ed327b

SHA256
3fb90aac9e85e7b0717cc452dc7d6473235507e8010b8871a53e5e75520c5ce2

SHA512
5cabfcc8917afb2a0e5a8521f00c0121311fc08e4d3025dbd90a674e3ef8b70adc2d7a308ab8e1554576bd3263e5799fdf3f419e9956c64a4c54f7dbfd0cd1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a5fbe868eb1912f4c518bfeb2e3ae2af

SHA1
e7cd99ad0624c900dae6f61be170f25b420b7e69

SHA256
cf6f42f6479518e9d21c1cbc142a0221c58fc81035b727e1bf7d9ebc2fba7e26

SHA512
ef27f2c16078f1dec841c1bf35ed0590b6d8290940e2a34c2649ed7b39628ef0011419c6a3e9284de723a8b0fbbd23a7bd9067e9625c09c2147b78ae277b3a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
248271be7c6c81a96023d97aed5b72ff

SHA1
92fc6728aabafbdd6fd3820ae88a7ab611dae1dd

SHA256
b779d0b8898254443f113de01a179f660e2d6369c76f1139e9e0f5902f25ace7

SHA512
404aa4950923e9f4aa00e05cd999728439aa1a87a72762994c20fad569d6ac6bcd9a4d672d282c9475c2090d161d6ddcdf8eb250e5b3f3789bac6e8fa8980e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b810.TMP

Filesize
704B

MD5
6f12bbfcc971c1f3373606fe707e6613

SHA1
ee78bab2a264f97dcc3fc13037523eb35ab84f14

SHA256
c33d3fc87af4d6f1b18cd608870421998cec157c52b91897afed1d92e553eb22

SHA512
546fb17b0c00a95e317250d84d2ba28cd2dcc3e7dfa6cb7ae554052accf2dbdfdff75651fecb04e8d5fad372050f01512a44b46e91b5ef225b7a457e8a313b28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38c190cccdd82cbabdee2322d8a78838

SHA1
c4e191cb644c431a5a0fb2b3095ed4042c1168b5

SHA256
4ce1f44eb01c7b05712986f351686b29a92bdbf56171d44c5ff3c79887344c7d

SHA512
2e2772422c2b7c4e6510a2a20b873e4728979e19789db2aea3f6472f01e4e20754599e0445142d73159ce27ac1100cc15462e1e0bae160c577228de0b07d3505

Download Submit