hxxps://www[.]greenvelope[.]com/card/OQLJyrm/0

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.greenvelope.com/card/OQLJyrm/0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3216	msedge.exe
3216	msedge.exe
736	identity_helper.exe
736	identity_helper.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4292	3216	msedge.exe	83
PID 3216 wrote to memory of 4292	3216	msedge.exe	83
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 4716	3216	msedge.exe	84
PID 3216 wrote to memory of 3056	3216	msedge.exe	85
PID 3216 wrote to memory of 3056	3216	msedge.exe	85
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86
PID 3216 wrote to memory of 960	3216	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.greenvelope.com/card/OQLJyrm/0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8650446f8,0x7ff865044708,0x7ff865044718
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,7225535631722933421,7409230730530226219,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
62KB

MD5
80f45b02501ce67a396b7ae81f5a35cf

SHA1
321760153db4ec9286ccd9e994d3e17c7975c716

SHA256
1c01d0ddc67b73b10890766eba15d8de18cc7a87602254ed08561477fc98fd9a

SHA512
80fe52af7dba6ce363eeb10bb75ce291df59d215ea6093f0829ee61ebb2ee2e393972e01b94c2a384b3ae8ffe9114fb3da76577f47edc8c2cecc22be65d559fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
64KB

MD5
73550d686d69a042bc81db8cecce72c8

SHA1
b4313fba569da074b041faad241615ff54263110

SHA256
238d3f159b97b6d9d3602ea9625f8556825c09ebd6aecbefefe0e65229efd2ee

SHA512
4c620a7c3ccfa22141f900c647efb54c53dad2f04cdc72e7185d5697ec6a101642f4e9edfa8b3945a1a77ae4c147ca36d5f8eb40bae62efdf28cde16ad293c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
61KB

MD5
51ed100e20d1f1791ea4a3235b8eba21

SHA1
690e31b7dd2c088cad256e8edb95204929d31f72

SHA256
a8d0b6a53dda0999ed10d7d31bcea5552158f56fb7730d2d0ad765ae40b887cc

SHA512
39ee954be769df8dad2be1f9b9cbb0ec1bf474c6c143df060d01da61caca73e6b4ff9e1e001cb0314477dcad1df3001423862f016dd607a4f28975bb49c3dbf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
54KB

MD5
bb572f44ad2f3ba22c621c41b15b49f7

SHA1
face92ef19d89a9e5284b1006da5b908bcd1dcd5

SHA256
317296d5ac25dc150e7661ef08eecd1bc8001271827b86c2af69e8be881e8599

SHA512
570fa298db8f76ec76275c20f36714d37158a393e4c6a588d4bc233c756f17ffe208889494d93804fc1056f13cb64412881988bf2c6f7e4f89ddebfa59d02660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
7c7ebdf842f73ce80c58d836077152b7

SHA1
ff132bcd749ebc2568b441817f2df1c0d69ed1ff

SHA256
7280e7ed5474cc930f78ae2b14bc901f0c0e5cb9c91846ee5aab549245d7f8ef

SHA512
a706f3385f36bde495e586e546258b2961d3f835afbc8d9620d2af500466447701d2eccf9db20378e16fa402117afed92bd21ff8272cf5aa7243eed969e05978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
40a552401b475d2ded034c33a69d2702

SHA1
7ba65c08b8750d5fea7f675026d1b9d580993696

SHA256
6d0c954dd884e80f15c2750a95fe3ea8345f8c7d01ba788b42f8c7de00e0652e

SHA512
194fa7f1c9f931c8488f1aa041ef6427433bdfb746970954656e18ffa2e6f21de47aed18b446282c89ccb9689f4e6a2957da36979af881ad6808b890f8315318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
56abe152cefceff9acfb142f4106aabd

SHA1
aac632aed86990ea192bb31824366692ba6df350

SHA256
8a644b9758900b7edf32a4872360531d8d98a2dc4d56c627149d778a247c8a7d

SHA512
823c4751b4f907a45e71accba6a4c03923ab93d88472144eb457391526d73ae5155fe034c628517b625c9c1e2c64f1aac4f14f9974b32f5a9dfd183b30fab3f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6346b4515f7fa5903719fac672f2ee76

SHA1
f774972499eea19f4d4a8889f862285cfbacca5f

SHA256
ff6148f48ab6c049c09ff419c0e3e60f1f9cf19a980275aad12753aab65f207f

SHA512
e819ec684c9d9ac7fcf6bf9cba204082b006390ce326835958c323c307c5c566a66767e48caa95e4b06083f03ef58473c47b9b685be041e026703ba785f7b2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af0cd63090571713853ab88a39a35900

SHA1
5921006f79051b0abc5afbd4079f3bfb068d38d9

SHA256
57c6f2ce63a67f745b677f7db20895fa36b4cb72a8faeba4cfb001f96eea32aa

SHA512
164c9a8f3b4003ad018e4e122b860d3071c61699339f1c64734fd9e2849c136ef2babd938440ed18a2285e069f3f715591938fcfc213f9bb1833037c457822de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ca8859af3187a6773ada1c856eddab29

SHA1
84074f601ab22e1ed8d956976dc504dfe2700010

SHA256
2cec1b31442a9d07ec6c2961ab0ee9967c8c708a60bfb10e3fb8d4ae1663343e

SHA512
7c682445a36de74ff78fceb3059b073fa1493cfb456dc0a0ef774eb5a47e636d21c1a28ab8402021267dfd53c027eff34549cb17a9af3b04f0de365e04de88cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eccd29603266fabbc2946e679653f769

SHA1
5f225cdfdcf67664fc23d663f7f006cac653d329

SHA256
7c38cbefff862f0aebc0dcf61ee72e253c0dd5266462018a96486c582e74660f

SHA512
bd2ed2d127c172f80726a220d546acbfedcfac9908fdbd3e3b903bf788923dc8d74fb9f97f0ca9db505ba0304803a93cfdca7b9b0070b20d9b507069bf9abd10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
662cd060b2cbf361f48fc2a7a4e357f9

SHA1
3f26faa2229d0726f1c0b5e57be5a57c1d0467b8

SHA256
1df08fa05a36fa256b2fb3b962f3b5849481b80a5fbe5903161a66004366dbd6

SHA512
6d0e7a12d94a3cf488fe3eff0747523e746542873b3a3f1f504ad094f4907b9b9b964815ec400282cf6f17ba43cc2dc175f5f5512c1c51b90381476dd3d645cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d41bd106e4ebc74256cf648fb5580e91

SHA1
fc2bb785ab2451eb5be0ebe657d84abe185c30c8

SHA256
5448f6570fd7d75a6f0ab886d31a2dd7319dda643212d430a4ab33f2abb07a41

SHA512
8d20635ecf5c324d36c35a6acfce18a427abd9a3052939071afdbcbaa5504aa00a6477e79ca15838e52169883d8f3f62388ddfacf5a53ff5879693fe09ecdcbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
06b94e0601599fd4642aeb0a581c1cdd

SHA1
17ad75a9a462b0a0adb006d8ee48283acc03370c

SHA256
cfde7b87d2b7c404ab8a2a4e453a3be17f226fe37b31ed71a7997aefbb8d2c67

SHA512
7b28ff22aae0e11d4d6dfc4ee698b50699d44d0f06744a2ff68397c28dcd4c976069e8abb4d5fb79356295eb14fa0470196e24b23826857841c589b8a2082f1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e4e9d7033d5bec9dbd2dbae1278be02c

SHA1
6cb5362a250ef2e19a083bf8e78b808a9abb8ce3

SHA256
305b36653b92deadcbcccd4dfeb690b77f1a330bb6440e98620aae55a6f11ef8

SHA512
ad03b7f078da3cbf9e101d56cc5552fc0a4cb97d6f452886b341fc73d757457f7d63f55a081d52e2e1a759c796f2b3325ff98805b9c234c348d6bf3f6ff6a60c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
793388d5b3275f8aeaac39e3f0d3d4ab

SHA1
d0275b694e11c520d6780bcccc48964f0cfb84f4

SHA256
014006e51c6e434be775386bc12f1993ef0acef911f5784347e24826afd64de2

SHA512
b40aa6c75037851f35682267894460518efaaa112440b3f029b8a53ef2e6049b29b9385918cb77bd0a6cb504e754049519622feccf99cb30f7b2c47ef69e2d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f86a.TMP

Filesize
1KB

MD5
02cdc0157c90229864d317d5e749d321

SHA1
2f5c5721da6d05354358b81dc2b2dd784b36303d

SHA256
3bb37a8e145e6675aec50c4454b77883e6a2caaff336d42ba8a476911d1c66f3

SHA512
b27c5c61b45cc357c7221d7bfb0a4d7c71c0dbd62568cb9b8fbede35cae4bdced4f59ceb1f61b9153800c6da2f33c8f9bacb10b88eabb29322921e3d16318b6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
014994382189931fd06329eb4e7da7f9

SHA1
0474a26eef181ddca251c972a11776f9f37eff70

SHA256
299d278b67db614d0423dd73c853a9c1987ef46c4256515ca8b7443338c080c3

SHA512
75603d11bd1a0e5cba1a9096ae04bc1d75d60b5ea1af54b9580cbadb0d73ea3b323afd22076978db6e5ba301eacdb4a5cce69d41b34b3b8712156d610a9cc4d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit