447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101.exe
Size

38.6MB
MD5

2e75d3c7e817581b378bbcc75082281b
SHA1

5b45e7eb54287486ae76768a20d46087204d95e7
SHA256

447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101
SHA512

16d2b42d8f6a0076129b8a6cb71b0a7c09f31d834b598e7790584bdad743b772f2d7cbbd61e8726ff6bd6f5f0f52009c5542922cfd50fd6af544a346d9218215
SSDEEP

786432:8Kn6iTfRwFOUPofAl2jtyGIdcDxvVEyaPZP:Tf2VP9l20GMcD1kP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 506985.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
4672	msedge.exe
4672	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4672	4848	447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101.exe	90
PID 4848 wrote to memory of 4672	4848	447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101.exe	90
PID 4672 wrote to memory of 5040	4672	msedge.exe	91
PID 4672 wrote to memory of 5040	4672	msedge.exe	91
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 3680	4672	msedge.exe	94
PID 4672 wrote to memory of 3680	4672	msedge.exe	94
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101.exe
"C:\Users\Admin\AppData\Local\Temp\447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b12646f8,0x7ff8b1264708,0x7ff8b1264718
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5604 /prefetch:8
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6464 /prefetch:8
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6464 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4708 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
7fad69d675a815e0ea4fc90433d7b672

SHA1
1cbd7bbb04a00f9809a0a50ea1f8df2bb3909e32

SHA256
4e3eb0ac9303ebaf7b3466f34432fbace889223d630edf396665f96cb1755230

SHA512
9fffba9b3602ba6d84e5c3659f720e7a306f46b06a9cd7bac34ee9d1e0b43bb55d7617c924b380c8603c3af38ff394a5a22c9475c4c06f6498022baea0ab1258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
11613da5d58f7e3f1f40b650fd8623e6

SHA1
328689978a55b0c59ab6e150cb908dd9285f21aa

SHA256
781d02a65958cf1407d0406f0b773ad92edac061b6a27258add0ad1a37c25ba8

SHA512
6e54f133500951a2ac30c976f8a41b4072fdbbfe617fb063b37367e72d5eeff2a172d545ef4ac5747bdd60e2d1d961c223a8a56cc9181baf23f6be65e308f08d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8161a44cf39ca386733ba51c4b08e77c

SHA1
71f4b3ac225e65ca8fdea99aa4a22d1d67064e67

SHA256
09cc66ab2661da312b9f3ddfcadf89fcb943af55063e21d2f9e91e8bcb4ce3b3

SHA512
d79e13314191e9c9ebc7d10ed0377f78ec62515f3f9af8925f39a8665271921f19fa71b0007b3106bf2b73da9a2024613678e7f98a0a5c02b93389742e0f016d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0a7c9e8516454121a730c9f27373f38

SHA1
97d226e986873763f7b138a415ed942e36a073f9

SHA256
9dbe3d956333ea6eaf3785bdeef48e8eddbeab255705faa400403e07f423f119

SHA512
ecff4c652032e35863753d84283bbd17c0fedbfb582b078fd13f6917ab9e6b30d02cb40adb88f0cbca007d081539a612748af76357608570d20a6c5e65c9dd53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
440e710111c9fd5ef2e414028f3e1402

SHA1
e33f8abce6cea73b73fec3e9ae9a7d3f7f37a21a

SHA256
61b0238368633088309d47d843611235b7f3cc88105657239fecbd4859a88978

SHA512
fc645e1c567b4b36de293543de98f0503442fa7c532aa639991abacfe646fadc96def6926ad196155d59d36493f06359e3effc9e566e271e4b5117f508df2ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
4e9e3d8236c26e5b3775430e638dca07

SHA1
65484a54daebe1a390e57762d897651ad831560d

SHA256
c3f32772aaaa9dc8a8d01c0143bdb3c249c77b0ce8665cecc8c32fab6af19895

SHA512
f2d036eadafd564488926b28d0b7f328b3445c4643a6e3422367b4ecd8d16123b16a779594a2b3afdd70e561d8412d646de2ed86442921d1a6f2d453f533ea5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5886af.TMP

Filesize
535B

MD5
d31f74b60f1d7b68486ea1b5a1278a01

SHA1
132de003846de31ff7feeef9f99bbf1143d7d913

SHA256
77c1bd2fe666b630d5fc958ead86c2fbabeaf4e57db35ad37116ec21976238d3

SHA512
559a36d63335279fd9e3dc5843b47ac01b3a889eb8fa6c57e0c7b87ce2eaa948fbc4348bef18c755faa95589cdd4f9e0d231234a514f2ffb5e81004cf6f81494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
92b1a48382a7115dd0f1117f79bb9bb6

SHA1
16b835aedcebc5e31feb9fae808b96dfbc0174de

SHA256
39b9d09bcf012dcfcc5e0f918d3cda9ebb531baf225c4e141fd7090e01e165bd

SHA512
f338f0a542c95cc242295d1ec312edf699bce0dd78decb6e48f764f5ccf1f85d760e798a22235db486b9123c437bdfe832e5152205049fd851ca15bc86abf55a

Download Submit