b37344357f3cad9aed5348c652021a9a8252e489e2b1909e4317b68343a73bbd

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0af07b2815eed139b6c63b19a1657b29.exe
Size

192KB
MD5

0af07b2815eed139b6c63b19a1657b29
SHA1

0dc3842607c47d68a6ae1e528fe3c4154d9ff2c7
SHA256

b37344357f3cad9aed5348c652021a9a8252e489e2b1909e4317b68343a73bbd
SHA512

9186443986cf3822f8bec1171966a66f0769027a71b30509f4503a69c97992572335fd1a1059c6984f93e024284986dd6444c8022f169a77256c171607861304
SSDEEP

3072:Q47FCYO0NJQ5S0xNcIA7qVJeNGV8e8hy:Qvd0AEnCVJeNGV

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2532	msedge.exe
2532	msedge.exe
4796	msedge.exe
4796	msedge.exe
2816	identity_helper.exe
2816	identity_helper.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4796	4956	0af07b2815eed139b6c63b19a1657b29.exe	98
PID 4956 wrote to memory of 4796	4956	0af07b2815eed139b6c63b19a1657b29.exe	98
PID 4796 wrote to memory of 732	4796	msedge.exe	99
PID 4796 wrote to memory of 732	4796	msedge.exe	99
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 3608	4796	msedge.exe	100
PID 4796 wrote to memory of 2532	4796	msedge.exe	101
PID 4796 wrote to memory of 2532	4796	msedge.exe	101
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102
PID 4796 wrote to memory of 2304	4796	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\0af07b2815eed139b6c63b19a1657b29.exe
"C:\Users\Admin\AppData\Local\Temp\0af07b2815eed139b6c63b19a1657b29.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0af07b2815eed139b6c63b19a1657b29.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7ebd46f8,0x7ffa7ebd4708,0x7ffa7ebd4718
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
    3⤵
    PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,10981879555454058715,13366607061045432214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0af07b2815eed139b6c63b19a1657b29.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7ebd46f8,0x7ffa7ebd4708,0x7ffa7ebd4718
    3⤵
    PID:5264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
aaef4e7530cc12681bb7094fe6bf075a

SHA1
718789eb395771829b28978f8c125ff6aa6a7276

SHA256
01e3ec3b6789be2a784c6a17250acd3c3d95cc11cb7e2968f3d2021b99dba6cb

SHA512
1a30711e57e8a443a8854b2d3b828002df174ab76d3a38fec255b733f4abd8687d222679013e9e6eb955915cbdde816cf775c9fc449759104e5de0640a4be2c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
1fb226df076cee8ac549ee96124f8073

SHA1
59e5f8caa2adf44ab79ec06421a1d2c71f7fc80f

SHA256
9f3da95b6ea8b6a1184362417d2962440cd6dc378f2edc88d45ba511ad3b4aae

SHA512
f71f1c8848f2a08620b40bd8b2d27f0cb7b0437b0ba1e024757ac77f7868c4c06793b5fc6a7100578fe5c54e8079602aebe07caef8013ed18f83a99e51fb8958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db8bc18eec596b8d605521d61907c3ac

SHA1
a7496fd7ac1921c182c126085871c89daa10fc89

SHA256
84069370a0382d0a3196599eb6b5ce87bf292604892de90228224076191db480

SHA512
1c43472f54acf9ac9555a94a66706a8037ad08b2645f98485116a886670862773598e8367b5af9c087217358dff7e7645f4b5bc8fdf2072227fc974099640d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e06f4f28c95192ba936a1d1e9676aa8

SHA1
ebe2d905f1fd01f612077d037e2f50e90a42cf24

SHA256
2c1630f5152a89251a4bf04f8bfc5e5210fdd97078eb967bbe47d0b64242e209

SHA512
15346da1e7c8de915f67f417c4bcf11b053af585134d8b2b490384a4cfaf06ec9c469b396d504a44ff63fcf20df1564dc9ce1d79adc859202e7b369f6c9a339b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6aeee8f774c79c0f96aa78edc520ff01

SHA1
a2197eca693b9d6e626ae020878d0f9e5788d371

SHA256
0dbf874f0350f9718d3ddbbee6d26de976ac0d82f965333975ca035c281f8dc8

SHA512
bf85d54193dade2da94083c4bf91f786f36054002cb09a2a9fa4923632ddbaba75098c7e827ae73740c05048f9cff5132412178b37d49b49cba84951361c7ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
06de2262573e04955f7d5d72e026cca7

SHA1
84e83a4cb5be79bb45ad2c3e07bc1cd2e0b279e6

SHA256
9cd41e20a999039d54a11cf10286741225960c7582bb9895e18b23c58144446c

SHA512
918d0a89369c3f54f756d27b159251aaac697656f3f9b362b0e2981ec4324b9d9c519733d35116a42df4c81e9f6b44c4d796633f1a012fd57df7e7996c240318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b045.TMP

Filesize
371B

MD5
be267e2cc305c0da0542f395e55b8c1e

SHA1
178f7afa41378a7a32b2f68cd318ef4f84729820

SHA256
2e3931b18a90cceab58ac23b18540e1e0741b4c2ed148ebad46430e01255aced

SHA512
a14c4b7fbfd116b58bcefec4984834a28cea7d76f08c66a15d0d86d25d060329a274460fe4fc6773ba193030488eff69b0e153a1cdd53e9bcc201f191154359a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3f6d952063064c668f257c6956753993

SHA1
dd838aaa2b04f7b0a806d6d8411d42f4ce317c67

SHA256
bd243ec404c04452df31024ee804061cb335553cbb593747c83eaa6b607a4473

SHA512
a760d7a6de5e9636035624561df8d7875dce7220eb73ce0b4320c5cb508b11d9826f108eeb366d621119110cfb16f3067047f12381253fea528259eaa3ebfdd9

Download Submit