681ecae76edd9d6c2c640f55d7da9680b9648cba34a7ab7b887efe3e0fcef6ed

Analysis

max time kernel
154s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

681ecae76edd9d6c2c640f55d7da9680b9648cba34a7ab7b887efe3e0fcef6ed.exe
Size

37.4MB
MD5

902cc8937fa24a3680636f485563e854
SHA1

0da16a46dc949ae9749000d33359f8816682100d
SHA256

681ecae76edd9d6c2c640f55d7da9680b9648cba34a7ab7b887efe3e0fcef6ed
SHA512

cbccfa2c40267f327fe5d16750a2ca5e97fde1cc5edd2428e6adc438bc9e9627344f1797a8f91cef78049212a73ad81f98ba83105a61d759c6575efbf5350565
SSDEEP

393216:aRqMInoJITfRwF6OYPlCPPIQAerCTat4jNQjJ47y3JTcDxvVRGPWdtMPD99:a9iTfRwFQuMXj2Iy31cDxvVcyaPZ9

Score

6^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 24409.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
3340	msedge.exe
3340	msedge.exe
2864	identity_helper.exe
2864	identity_helper.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe
3340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 3340	3156	681ecae76edd9d6c2c640f55d7da9680b9648cba34a7ab7b887efe3e0fcef6ed.exe	90
PID 3156 wrote to memory of 3340	3156	681ecae76edd9d6c2c640f55d7da9680b9648cba34a7ab7b887efe3e0fcef6ed.exe	90
PID 3340 wrote to memory of 1684	3340	msedge.exe	91
PID 3340 wrote to memory of 1684	3340	msedge.exe	91
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 1212	3340	msedge.exe	93
PID 3340 wrote to memory of 4724	3340	msedge.exe	94
PID 3340 wrote to memory of 4724	3340	msedge.exe	94
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95
PID 3340 wrote to memory of 2288	3340	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\681ecae76edd9d6c2c640f55d7da9680b9648cba34a7ab7b887efe3e0fcef6ed.exe
"C:\Users\Admin\AppData\Local\Temp\681ecae76edd9d6c2c640f55d7da9680b9648cba34a7ab7b887efe3e0fcef6ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.9&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde42b46f8,0x7ffde42b4708,0x7ffde42b4718
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4016 /prefetch:8
    3⤵
    PID:616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,12026130466609105241,10104256404465741939,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
83b5a2cad961eb2dd9981c024d16621d

SHA1
cdeef71063b10325885a45fafadffac53fb4df1b

SHA256
3efab7202839c3240517845c91dee4b14c8f37e0bba283855937e8d9033bff93

SHA512
a7fd66e471cad538eb827acf28c47367c6c03b24add030c6017997c651f8541634d6d06caed6465f5b27f7aa157e5ef65a1daa0528a5527ca9cecedfc73f5ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
3f67dd742bcb7d4ce4eb52bcf539c256

SHA1
0794c12c4bc9bd70908f8eaaae85610014117fb0

SHA256
51cf3d00a8e595e3b3cb0259459adf20ba6abe1f085a8841bbea26ef9ed00d44

SHA512
477b6318495e15d115c737d99bfb85bcefb244e41446e043b22d04a9f263033757b39d948c4c7194d29a131a003a3eb7350dfac2c2845b7994ca5b70a54d6444

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
902B

MD5
cc18e41a5374f9d7e37576131af185b2

SHA1
f67496fef7c3b79f0ad7f8bd86cd85be4656f10a

SHA256
36939e1df5c664baa8258435185c4b30409563ea9d5e6c15c6434c92aa0cd6d8

SHA512
5b2fd76ce88df9464dd4a719eb0a171bfc5e1230419bc120cdac8437d9b1b4703b09293137102f9fe6957697629e6eac210e16bdea82dd4b4667557a2de38b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb0e1c590a91bc064cb73242b132ee04

SHA1
d91d9938a5e181f1258134aa170575cfcf544f5b

SHA256
e02fa18ab0e6ec35b28ddef4291ed21af1701fc86654b2e02f45d57a46faa884

SHA512
2b10516ed3b5c3933bd317bf2ff269315febdd21630834ef45934bcd206e7e0b60fa13a9f276c533c31e843e994200a65968aee238b10a9479ec37b93874f6d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f92e8a042dc2462073dd2345012c619

SHA1
4a93ce62bbbbb48f93c3580698ce9c115515c8df

SHA256
f93b064913e8a7ed5a526c83ce7918ff8f46ef5b41c94b03b8bc300276f9df42

SHA512
e46b54a1fee796df1e22b898fb1ea88b07f8d63b3193b868a42377de104de6f33c663ff4a23ceb8559b6bf0bf57822b6c272c0a06260bfe38acc64f8d80d3c32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
d3317da034c7a1e8cdc814e2320c09a7

SHA1
c927af022c9ec7844a769cf097d7189ec8b31f00

SHA256
ced478f0065a45f01f5aa1964270a9e5338209651c0ac7d28079588feef85ec6

SHA512
b5f62e0207081aa7b3ae9e8d7445bee921a1dc6fb063b6b8fe3b36ba25b98f83907e582b71d09a848a7e164790b4060f11544c689fe2468d123de9e07cb6f9c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
676518a2ac00ccfcb0219e33413ba010

SHA1
4e141185cf9d75666080253714125d43fb811081

SHA256
15b1e9b5c780cc1c11191efa842217f4e93be1fef05d714cf4e9bdae2b177aa9

SHA512
a701b840d5889bcfb4da7c45c9154a86375ad2e5ac857466fdb7f96fa68be8b286d186cebdfdd4b561201fe88eb6124bc00a158a34299adf9da248d36b0245d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b13a.TMP

Filesize
539B

MD5
41be5cdf6bbe16e50d6ad38a85bb37c7

SHA1
f12fb2f92b18517a28fad20be3d3db9d36a6140e

SHA256
422dd4ccdfc45f15aab3950fad2515339da9a1b8b0e9a3996038b7c161ba6c21

SHA512
75f47a1a58fd24537df33fc0be93c40238c5e11f32cb556e448657cb6876d4c14fe84da2459c0891192341272982657d129928f64714235f3b3a838a8b14d594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
442e99ec20a81e1cda5abfe156a4a490

SHA1
fa1aff330ae259a6afdfc226392620a3e31b075f

SHA256
98c22d5a1e833d5abc46bb3abe60b04a45362a89764374daca1cfac5a3c20b4a

SHA512
78eb82754339b8a6adb0797f23df506f70337f280470d51494706a38f3c0d5efe6fe9568d58b5bf66028388819e24109b85174545431574c52683ba854b49508

Download Submit