hxxps://www[.]google[.]com/search?q=windscribe&sca_esv=5d7305874509b4d4&rlz=1C1GCEB_enIT1100IT1100&sxsrf=ACQVn0_yOWOsnbA5FswJIzTYIaofOPy-jQ%3A1711629545790&ei=6WQFZr_pL9apxc8P6s6R2A0&ved=0ahUKEwj_gcH4_JaFAxXWVPEDHWpnBNsQ4dUDCBA&uact=5&oq=windscribe&gs_lp=Egxnd3Mtd2l6LXNlcnAiCndpbmRzY3JpYmUyDhAuGMcBGLEDGNEDGIAEMgUQABiABDIFEAAYgAQyChAAGIAEGBQYhwIyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyHRAuGMcBGLEDGNEDGIAEGJcFGNwEGN4EGOAE2AECSOIPUMUEWPcMcAN4AZABAJgBb6AB0wGqAQMwLjK4AQPIAQD4AQL4AQGYAgWgApoCwgIHECMYsAMYJ8ICChAAGEcY1gQYsAPCAhMQLhiABBiKBRhDGMgDGLAD2AEBwgIQEC4YDRjHARixAxjRAxiABMICBxAAGIAEGA3CAh8QLhgNGMcBGLEDGNEDGIAEGJcFGNwEGN4EGOAE2AECmAMAiAYBkAYMugYECAEYCLoGBggCEAEYFJIHAzMuMqAHrQ8&sclient=gws-wiz-serp

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/search?q=windscribe&sca_esv=5d7305874509b4d4&rlz=1C1GCEB_enIT1100IT1100&sxsrf=ACQVn0_yOWOsnbA5FswJIzTYIaofOPy-jQ%3A1711629545790&ei=6WQFZr_pL9apxc8P6s6R2A0&ved=0ahUKEwj_gcH4_JaFAxXWVPEDHWpnBNsQ4dUDCBA&uact=5&oq=windscribe&gs_lp=Egxnd3Mtd2l6LXNlcnAiCndpbmRzY3JpYmUyDhAuGMcBGLEDGNEDGIAEMgUQABiABDIFEAAYgAQyChAAGIAEGBQYhwIyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyHRAuGMcBGLEDGNEDGIAEGJcFGNwEGN4EGOAE2AECSOIPUMUEWPcMcAN4AZABAJgBb6AB0wGqAQMwLjK4AQPIAQD4AQL4AQGYAgWgApoCwgIHECMYsAMYJ8ICChAAGEcY1gQYsAPCAhMQLhiABBiKBRhDGMgDGLAD2AEBwgIQEC4YDRjHARixAxjRAxiABMICBxAAGIAEGA3CAh8QLhgNGMcBGLEDGNEDGIAEGJcFGNwEGN4EGOAE2AECmAMAiAYBkAYMugYECAEYCLoGBggCEAEYFJIHAzMuMqAHrQ8&sclient=gws-wiz-serp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1488	msedge.exe
1488	msedge.exe
4348	identity_helper.exe
4348	identity_helper.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2664	1488	msedge.exe	85
PID 1488 wrote to memory of 2664	1488	msedge.exe	85
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 232	1488	msedge.exe	86
PID 1488 wrote to memory of 1528	1488	msedge.exe	87
PID 1488 wrote to memory of 1528	1488	msedge.exe	87
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88
PID 1488 wrote to memory of 4152	1488	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=windscribe&sca_esv=5d7305874509b4d4&rlz=1C1GCEB_enIT1100IT1100&sxsrf=ACQVn0_yOWOsnbA5FswJIzTYIaofOPy-jQ%3A1711629545790&ei=6WQFZr_pL9apxc8P6s6R2A0&ved=0ahUKEwj_gcH4_JaFAxXWVPEDHWpnBNsQ4dUDCBA&uact=5&oq=windscribe&gs_lp=Egxnd3Mtd2l6LXNlcnAiCndpbmRzY3JpYmUyDhAuGMcBGLEDGNEDGIAEMgUQABiABDIFEAAYgAQyChAAGIAEGBQYhwIyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyHRAuGMcBGLEDGNEDGIAEGJcFGNwEGN4EGOAE2AECSOIPUMUEWPcMcAN4AZABAJgBb6AB0wGqAQMwLjK4AQPIAQD4AQL4AQGYAgWgApoCwgIHECMYsAMYJ8ICChAAGEcY1gQYsAPCAhMQLhiABBiKBRhDGMgDGLAD2AEBwgIQEC4YDRjHARixAxjRAxiABMICBxAAGIAEGA3CAh8QLhgNGMcBGLEDGNEDGIAEGJcFGNwEGN4EGOAE2AECmAMAiAYBkAYMugYECAEYCLoGBggCEAEYFJIHAzMuMqAHrQ8&sclient=gws-wiz-serp
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd385346f8,0x7ffd38534708,0x7ffd38534718
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3876 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14168740065572001467,1809062527419199323,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
198KB

MD5
cda68ffa26095220a82ae0a7eaea5f57

SHA1
e892d887688790ddd8f0594607b539fc6baa9e40

SHA256
f9db7dd5930be2a5c8b4f545a361d51ed9c38e56bd3957650a3f8dbdf9c547fb

SHA512
84c8b0a4f78d8f3797dedf13e833280e6b968b7aeb2c5479211f1ff0b0ba8d3c12e8ab71a89ed128387818e05e335e8b9280a49f1dc775bd090a6114644aaf62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
159e58b383a05d5b13cf037d476be359

SHA1
7ad5a3be4eeb7e92eaada3b4945759049cac879b

SHA256
5da46498eb97bfade0fb528fc31d9acc94fa3c468bbc71a24c184d68e862dbf2

SHA512
1e9207b3afd8748ec970575a5c354577cc5bec0c4812ca3f69c05c5ec54df91531f04ddc2342d963a9bbec22d67e56328f590f7589ea638d644a3d448dabf0bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
814B

MD5
5975b8ee9fcc0a43b17bd32612118d1a

SHA1
50ca161a3f17b3ccfe2f338f0b6ed7cebb6e04b4

SHA256
362b5f71268346e15536e941a7e6ca2701159894969888ecdad57281a8690c9e

SHA512
af2fdb716151715f02ce8ef5b0e50e5c020e48b0997c0f9d1ee9aed928c50a25ae5327b2e22101fbe9b0474183d2b317a68c92254463ec330d340a6ebb4d887b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7166c6b7cb71dc5464c7a65d3efe04b6

SHA1
e719227efdc5e7a33831a4031989a9b559ebf177

SHA256
2e19b118c08f702b89239878552de2a5a139831ec95b8d423237e5e4eaf26f08

SHA512
d10e4bc950ce64d965ab7f320fd0fce714c6be86e9b78d110f68c18e731fa06d9f9a723c3db0899ea37f60e04bced8ad2f577b0b5a882b2c0b4b1bbc330671f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab08b2f4e9a35dd7f2a56c35960ad886

SHA1
463602a5058eff191b8e6115bf3541ac021dda7d

SHA256
803e1d9d81b1c149d4639c2a7d9a777ef14b372619f6cbc51e40ea15676364b0

SHA512
6f566d4f84a06ac0dfd0f7c8d3ca94b04d71b7318049e01760dfb5ee7d10a67b0c0cbc8620b8a107a3297cbef20c478caea4740a249c9d23378d3ba854be60e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7cbb7172e4f1adae61f8b24a74ef54b

SHA1
c1c646175947e1f06459d79462cc55e7a6b7c480

SHA256
f54f43bb779d9f04d1341f9bf30d4bd741731a15982fa4323ba2396a35337b88

SHA512
29f037171ba88973f2df5af5d8ab4ac8faa385fd8dbbb45406fc56de67a535aa954b81c15f0ff504573440c36130ed6239ace3e4b9a0534d477d9b6cf7b2cd84

Download Submit