hxxps://www[.]greenchef[.]com/plans?cjdata=MXxOfDB8WXww&c_comms=PERCENT&ct=PERKS70&tv=su4&utm_source=PerkSpot~cj&utm_medium=cp[.][.][.]

Analysis

max time kernel
202s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.greenchef.com/plans?cjdata=MXxOfDB8WXww&c_comms=PERCENT&ct=PERKS70&tv=su4&utm_source=PerkSpot~cj&utm_medium=cp...

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{607CC155-3A03-4EE1-8C8A-78BFB126F5B8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
4092	msedge.exe
4092	msedge.exe
3176	msedge.exe
3176	msedge.exe
2108	identity_helper.exe
2108	identity_helper.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4016	4092	msedge.exe	84
PID 4092 wrote to memory of 4016	4092	msedge.exe	84
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1820	4092	msedge.exe	85
PID 4092 wrote to memory of 1188	4092	msedge.exe	86
PID 4092 wrote to memory of 1188	4092	msedge.exe	86
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87
PID 4092 wrote to memory of 4236	4092	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.greenchef.com/plans?cjdata=MXxOfDB8WXww&c_comms=PERCENT&ct=PERKS70&tv=su4&utm_source=PerkSpot~cj&utm_medium=cp...
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcc5046f8,0x7ffdcc504708,0x7ffdcc504718
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4934849641781209850,2644505780813206824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
3259d133571dc4e274a9a3eef1a72507

SHA1
561cc6b3937100e310097e909b9b6f4ab666d8b1

SHA256
c00b72a1d3bccc0a20dbf633df069a2294e15c9ddf54ca651a8953a86099ee22

SHA512
65e2ae1ef2ef678f37499d62533744deacc4c56a3a02427d29aa463777252be5a62cf295549f4c45585f4674f2f4920cc4dbeed4ac8e826bb9c6df3d692e3479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
b5d5dc0357211a28d018fa98514d88f2

SHA1
05670963a902a3a76484c7173f4e5b23daea7087

SHA256
79b100c1518372f081b6280ea5f3aea953516a0eced1706093be926bed3a2f8e

SHA512
c81fbbf46a741eb4254aa54721ab30f34748cd6dd8bbf13b9fda9e40f6b939ad85a36eb20ecd6c88fe5bc233140a760e1ae42bb70c2cbe370d34d861cefe84f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f53fb7cd5cedf04edf58124f74ecf76

SHA1
87a870d3bfb451329a8adc7ed1ef6da2a7d04ed1

SHA256
0b40052c53e41d0baf3ae6a9b16dee8862b096cdd54e54200e75146e99ccdd77

SHA512
7943ec3004cb84f6ff1d0b4ec6c4cbed82a335c356c1f31bad30f59cc88c62357828b64a37b15fc7a427f159107a6ca6abf69d5550059063bd0078da06840b29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ffc61f6eda6e2b2ac2a0f20fb7fe7ce2

SHA1
68a819cdb77e9de5ad8810980c78e8ee02d4560d

SHA256
d2e35d99bec1cc4b2a195fd5a42308765e7f7bf138289a04b185b57525c184da

SHA512
3eba6ebca4e043023195f369c77af47cc77912187dc10523624fb1ce5ab254192cb0e3987dcc84c5718fc466b834aff750b13efeaaa7fb2671bfdeae0faaa3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
89393e4c80ac8e038620eb82c5774fee

SHA1
6cf3e4cd4ac0f6fbe3aafd92f2fb2b16644203f0

SHA256
f1d171483f0996446e8cf4d695009f8e5776ce45b0a364ab5acc77b388f24687

SHA512
375b1b7b0ea7469cb736d4540472c64991be50556c2f15ded0a36b0337ea5d05bb9b62029e4cb928171491de0a8b4f28f5fc81e1734ad9a7f6dba4c9b7f2c2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3845c35459e8fdd8546966474de5c15b

SHA1
dbc252273c20d8fd49de446d6904f25a77e3da39

SHA256
6537a72839461aa3c012157a1e4fe1086b153181bc736b48218a47a76e4495f0

SHA512
e0210e379b935f5353a4e866baebc1f8f7b2dda2f6d63c434139e781dc139fd3e32667aebdba464a4d985e30de0e45620c59af0fff1d261df08786af0ceb17fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6e2123588bd4d39f0f4a9c490ee03630

SHA1
40d0c64d20c60f5ededa07493e03907c9670ae94

SHA256
647c5d4c53f955e1ec6c2de37cad542982eee3933ea79de93198cc94445b18ac

SHA512
88b39be12d67ad6c01d564ea76676f274d7dc6dffcf50e6954426144be999c37a8d0d19563f50b44bf27333e093d680fec7251de8c4c6b802d0e8ed953a5c3da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fbf4.TMP

Filesize
2KB

MD5
3f220ce86b8cc9698ec1ce358ec10336

SHA1
a50d5c6f74c33d499eb9d1db62f74143bc8de9c3

SHA256
08ee54bc9289fc0a10e44a347484e880eb9cf9fad2f8dad7e2d6a1e6b25e1e08

SHA512
c30c0d153c4cd26cdd20ad353e10ce7a0b7fae235e014f2d457e2ad6559c9d24739467591494d0ba008f1db9bdcc405f2772bdc01412c86fcc8663b3b5c143f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
66d6ec7736faba1cc93f525fdd7657d9

SHA1
65a1cd9d64578ffbb3172c240888680d9d96ad5d

SHA256
a300e880b1a71b1b5f740e4b6860a6058ff654cbd5bb4ab71ae302772e7f9f99

SHA512
7559aa4a70d1053d8ad4a6c79184af87bb87622b97357c21046259e27d5c8fed23d2b76861431c9e9789414e0edd53818786bda6b52c6ad1582d9d4a1f8daf7b

Download Submit