hxxps://t[.]apemail[.]net/c/nqkr6vk3kzmvyhqvdmdrwaaha4bamaaabynqogyhdmkxs5qvdmkqcvagayhveflk-nqdbwfkcivnrkgyvpf3bkgygamaa4bqedmcagbahdmdrwbihaucacayadmdrwby3cupvkw2wlfob4fi3a4nvsqs3lmnrk5dypfrxm5ddc5rgifi3aadqoaqgaaaa4gyvl5bugr2ebumbqwsykzmviwczirbfwq2yivlbswcfkamf6zctivje4x2tlumharcdiqmv6q22lmkrwq2fijjbwaacainrk6lwcunvsqs3lmnvsqs3lmnvsqs3lmnvsqs3lmnrkakuayda6uqvni

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.apemail.net/c/nqkr6vk3kzmvyhqvdmdrwaaha4bamaaabynqogyhdmkxs5qvdmkqcvagayhveflk-nqdbwfkcivnrkgyvpf3bkgygamaa4bqedmcagbahdmdrwbihaucacayadmdrwby3cupvkw2wlfob4fi3a4nvsqs3lmnrk5dypfrxm5ddc5rgifi3aadqoaqgaaaa4gyvl5bugr2ebumbqwsykzmviwczirbfwq2yivlbswcfkamf6zctivje4x2tlumharcdiqmv6q22lmkrwq2fijjbwaacainrk6lwcunvsqs3lmnvsqs3lmnvsqs3lmnvsqs3lmnrkakuayda6uqvni

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
2864	msedge.exe
2864	msedge.exe
3540	identity_helper.exe
3540	identity_helper.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2464	2864	msedge.exe	88
PID 2864 wrote to memory of 2464	2864	msedge.exe	88
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 1868	2864	msedge.exe	89
PID 2864 wrote to memory of 4744	2864	msedge.exe	90
PID 2864 wrote to memory of 4744	2864	msedge.exe	90
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91
PID 2864 wrote to memory of 2516	2864	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.apemail.net/c/nqkr6vk3kzmvyhqvdmdrwaaha4bamaaabynqogyhdmkxs5qvdmkqcvagayhveflk-nqdbwfkcivnrkgyvpf3bkgygamaa4bqedmcagbahdmdrwbihaucacayadmdrwby3cupvkw2wlfob4fi3a4nvsqs3lmnrk5dypfrxm5ddc5rgifi3aadqoaqgaaaa4gyvl5bugr2ebumbqwsykzmviwczirbfwq2yivlbswcfkamf6zctivje4x2tlumharcdiqmv6q22lmkrwq2fijjbwaacainrk6lwcunvsqs3lmnvsqs3lmnvsqs3lmnvsqs3lmnrkakuayda6uqvni
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85af846f8,0x7ff85af84708,0x7ff85af84718
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2941984430924441367,2445763313294282052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
e21423b42294ff9ec96594f0753f7012

SHA1
5ce677c8d40825b4c6d77b7cab15ba9b2c194cf6

SHA256
17908e3b1195c0cdcd0496e5118586cc328132b33c2c3dd5c0975d0267c016b9

SHA512
0ff187af753b503c53978ae112fa243aa91bc0c34adf5f2c0f23c3e580c149346dccc38ff0024e2a85e5d3be858fab393f8c99b098718aaf498c7799e4282afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fca482ab7dcdbac48d07c63fce687ae7

SHA1
cc5feaec38bd26f05635ef8e275dd7d15959ed26

SHA256
887a2e68171cb0551c36f68a01d6e56fbe10c4d38d480c209a8740cd34e1affb

SHA512
19ffcbf3a84473b8aa8eb750c5c0406986207f777deba2c4721b98ee29e2a4cb2e972f9b305e91397a88037ddf8af803e976ed1fba93948fe589b94ba04ee910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
777182974af49d91170d44754b0139d2

SHA1
4ce18f95398d9db28cc819000a0520725723c761

SHA256
4688fe8bfb1e1bbe6237b61a885ed5ade4cfdac7a306da43a44410e385433277

SHA512
858b3c3ae20733353dcb8292f387d38b95167e461a13291afe9af68d38ebaba318c426c92980ee7a3fec8811a95e95ec8c72b7d9e00c534f5cf59fe49d541ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25d721af852235ba33c72d1898e9c989

SHA1
f1c92057fab860fbab0931ffafea02dbb4319afc

SHA256
a6f182a2ae69c18fd74be5d06e332c0079e1aa6e34d06d2faa02a3a92752c53f

SHA512
125846b06f100930a8891fbc55105576e2599823b19fa9a2658634e77f4b5f1104649f935df53d80171a62c632986e446f289503629441b257d8d17806b22ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f60d4ff21f045e65fccca5c40929c625

SHA1
9c20a135413377bd5176ffed3c2cbabe7f95b999

SHA256
2ccdfd71e13981fe2401f9c8bf7f5a2f4227a164db2989cc835c9d43056074c8

SHA512
d5f203f4c7e09c537efab36ba2f278bd093e419d9a87fe4ea3bfda1d3fa34d11a2b157edd61d8d3a10092a246a0849b52f60c8adddba68041fd159b76ff2f7ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
51c307f9351ad0865ad0650f0df435fd

SHA1
b5e01151667175b46665f86f27b00e3445a2634d

SHA256
33978c5cad32e5357b34f7299a9700f6f23781f8c6259e08d384bbdd23e25289

SHA512
155715fd28f74aa833657aeda2ba2e34fc36b1ed4ab928421d96bb85820e7e109b7f4eb42728871aaa00178fe54d1964dc0e4bbd9e55a636bd262bc28e238103

Download Submit