2bedcaca5df5b390599eb79890c36b3195a81e683f98b59398abdfa134219955

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2023, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4912-22-0x00000000008B0000-0x00000000008E0000-memory.exe
Size

192KB
MD5

32e906705578175eed6a06cf6191e8d8
SHA1

98b69df04d5a234be7e948647b12797889af5584
SHA256

2bedcaca5df5b390599eb79890c36b3195a81e683f98b59398abdfa134219955
SHA512

629f97d1594349ed233edc150c2b3a2774c670dc19dff15180700a8660cd351a4a961c4ddefa725c3a0c62a5c6b31134999d740e14b632f207ef111e70d21411
SSDEEP

3072:8wQwJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1Jd8e8h3:8xzAmmI0k7vVe0E0YIM13

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
3648	msedge.exe
3648	msedge.exe
4232	identity_helper.exe
4232	identity_helper.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 4980	1644	4912-22-0x00000000008B0000-0x00000000008E0000-memory.exe	87
PID 1644 wrote to memory of 4980	1644	4912-22-0x00000000008B0000-0x00000000008E0000-memory.exe	87
PID 4980 wrote to memory of 2872	4980	msedge.exe	88
PID 4980 wrote to memory of 2872	4980	msedge.exe	88
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 872	4980	msedge.exe	90
PID 4980 wrote to memory of 3648	4980	msedge.exe	89
PID 4980 wrote to memory of 3648	4980	msedge.exe	89
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91
PID 4980 wrote to memory of 4400	4980	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\4912-22-0x00000000008B0000-0x00000000008E0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4912-22-0x00000000008B0000-0x00000000008E0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4912-22-0x00000000008B0000-0x00000000008E0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a0e746f8,0x7ff8a0e74708,0x7ff8a0e74718
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5537490484990590545,13606284135145281393,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4252 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4912-22-0x00000000008B0000-0x00000000008E0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff8a0e746f8,0x7ff8a0e74708,0x7ff8a0e74718
    3⤵
    PID:2176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
bc65c4ca0cce71b92c7dfb245e73b0b0

SHA1
996f6c92732962cdf2e8cd961a761b2108fc2114

SHA256
cdc304c680c81957a105903374f6b10187fb5a472c9c08a7730849cb05e81632

SHA512
6a83ecfe115cbb5c73636e9f8253477495930c522801f7f32f0680678ad7932e36fa8d1296cd9ea0807f5166b157175f32b4f08e7f0571b635d3aef0b782e24e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ace6f2af90f995b23615e75949d8bc6

SHA1
c0f89a565d365209b6cd0b405e5bc139d7047e44

SHA256
9ca427fd0a62e4bf344df80a6ced4fbb770210d174f63339bfdf6c10c6670aa2

SHA512
ad7b754339b93638c0e0267df19d87464f6d8a388e1c8fc9446003e89be50886f90f90af22c037e24025989c37853f7e1707fd1bf81a0ab36dde1bec22b06f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1b907df28aff6aa40c7addd965caf2b5

SHA1
86b210efa752daadde4c536eb30457625f02979a

SHA256
9250de7a4d95635aea9a55c5a8054c6e773a767d0b2048819e3edde993f75487

SHA512
bdc9806e4ac896996bc23865ceb4d2caa09e91d1912909bac24fd6e3e07d1559c90ecf6a6448ca6be618c4a5d790b39e18a8e5619def9e52518043b9b120fc5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
1bef49a11d7e9eae078c008e4b0c0fa8

SHA1
785b04ba084bfb3a18d4a2917b58b83fa921538f

SHA256
598f0c99bb72bf05fe21c8e2ce804ff3b4935e55ba662fb1d7f7301cfa585248

SHA512
647f796303c570a049dd773e04da56c6a03d8afbea2891940e437e113188988825f22c52e8d67c4f1cf3e02e5267aec5311f27dfa283e9b3e2136dd2d6d98d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583ee8.TMP

Filesize
371B

MD5
64ab303f37a32710243d053466ddfc7c

SHA1
b1b18bcaf449e420bc43455cba6e2ae277f98c71

SHA256
4ed1182e44b437bbf352c65bb753fd618a9d8cdc005ee151796ffac4629f4285

SHA512
acce0d63cd71242a677f24648e38786955c918b64e3b3c4c2b164a012b3ee202989d15659c3b7bbf81beff6402fca8e5b5bf50c18d619fbb5867b2cd6762f277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2bb39f2537b42d7353c25ae6417658a2

SHA1
3e743e709d62d5b8313076b2691ce8109c2da2d9

SHA256
6543b431bf1cf56186433740e6017056ab653e360d77f46a8725a108689d7fa6

SHA512
1b71877b7eacbef446100ff6cc8ce39d493399d194da278d2692e7b1a1336247f3af4e2d8627b1254b04612089dcb1478d3b06b4d8ff3623acb12ded31e16a01

Download Submit