hxxp://wesetup[.]in/

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://wesetup.in/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe
4252	msedge.exe
4252	msedge.exe
1756	identity_helper.exe
1756	identity_helper.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 2400	4252	msedge.exe	86
PID 4252 wrote to memory of 2400	4252	msedge.exe	86
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 2044	4252	msedge.exe	87
PID 4252 wrote to memory of 1064	4252	msedge.exe	88
PID 4252 wrote to memory of 1064	4252	msedge.exe	88
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89
PID 4252 wrote to memory of 1364	4252	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://wesetup.in/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d48d46f8,0x7ff9d48d4708,0x7ff9d48d4718
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3114227653281202462,5597674527891897813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
d116820278dcf6f3c561dec44edd2972

SHA1
949e13f28dbcb08bb8d387b02546215781bafb47

SHA256
c79a1007094ba7b93fdbf90690e564e921bd68c96215ed0eae960386ee012a9d

SHA512
31b7a4048ffd721657b97b5a5691549012b6021d1b0880de66ba4d701960dc9c57e1372871ee9f6ae271c969c090246372a406f4754e344ebc2e65595093d96f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
d117a9edf03be69cd00f0ce07ef750ea

SHA1
1fd410a5b6509c2f8a6978ffa2d7ba6f20b819d0

SHA256
c6d5952d38e2df191d849cbc54c1be392141d50fcd10bd79154eb766a56d37ab

SHA512
62e9f1950472fb5189cc8570f7ae0043a17778dfa757a128dc888b10e7ffe0199feae4d6c1e75ffd129525aaf1e701bf6e8b190556a9c412290dccefe92f3e6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
733b20bda34dd807a908efed9420e7a7

SHA1
bd6bb6731dd113ea0eded1c053f24866f6dc5c7b

SHA256
932ebd9c0fd8b95995e02b0824dd260ec5252257d15d63c97d7f6663bbd6add3

SHA512
fde475877a7df131348b24dab31dcf419910fe2119d4239e3e424f73c10940c2ecc0f82e682295b11d2e7b780dc38acdf69e7f58b33ec13e2e77f0bde9aa4494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
1353bf1025e759249b152049900427c8

SHA1
7014f62564c15134cc37c8601b36d47c350dc88f

SHA256
f4e565c8f45e6833673b079a12232564adcc5dbc109ffb2f56e35903336c83cb

SHA512
03039ba8afb368e1f8b9d19ffc99bee7a0778dd27b4ae741016aed122f5482df2d801575c6b38bfbc8680a3c157df43d29fa430c66fafb9010768adb862cab0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2b941f64559593f0723440e5f9ea681

SHA1
ce9c7262ea95179983127b48b2f2ad409ceeb838

SHA256
0a770a18cf910839c504dc7eb0896366d3ebf1d0fbec03179efd5c7f8ff18a61

SHA512
c962143b3bd8d8a6d8ffa5d0f6b9e4218f99e56c9741f4612ee689648d866664397aa5be07b2c54520194ade09a7e8b11abbf66484cc438a9d1edfd62e052fe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64afc70659146397fea852a67ef557cc

SHA1
ed86a2188335a46850c66fb8a95d20b5551b141d

SHA256
11028e973864e0fcaae7ac6240e9cd52b0175f5ef2e50f19e98065df0751e855

SHA512
4346c0749064d29649a488dda720a61942d053713bee02c3249b55ed3e405dfe85b124e8ed7bced6c6d5cc46a146fc0d1ed3747dbaf4f7eac4aff4dd92733af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
db1e3502dea841c075b62c95f9a67bbd

SHA1
54fe126d764f110cd42b22532140d83fd3140f0b

SHA256
cad323f25ff25c5a1f1db25fe22eb8bbdbeafce93c3c97d6456d222ff5a98f1f

SHA512
ebce93ccc1002bc3f6d2f388b7ee5267f5fa6dddac15db404a88dd9bb834b9405042725a8cd6a348a28dbbb57e26fc1ace9d4b234f22b7832a3d0c70f865c789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
f3634a1e5f12f0733fa6a6c8e7e36891

SHA1
eb4dee60db9429a0e47bc9c03bfd1ca26eb77bff

SHA256
e68983e11170f180be77e4b7b97033baa909b27f2ebfac6a519f90e43d5400c0

SHA512
0a2407c7caa55540d58e9161cacf138d26fa78d845e7d9b1f41a27f9997cd1743060372fc7e48bca7cfdbed62a9344e3cee57fb414178445798d7f9d62c269e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585966.TMP

Filesize
203B

MD5
2d062dc11b20558e9fe6d9293979e088

SHA1
a7aa7f356bfdc564d32065f9c2da5affb7f4a113

SHA256
68bdf4e718ea8a470437a1e2c73e847c0ab8b971a42d1900f5c31ec762403d76

SHA512
0cd7735d7b3a74121f4bfde408d9c2bad00c3d6d16edf1f68738c0b9ec4d8ed8bd15ab6cada88190cb8ec522fdfef28eebcdd07ef46847a5e3088e4e5821f5e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4f6126a8c744d546d070cc7693865404

SHA1
d02474ec7433701fac264939f1e1a76bc154b391

SHA256
1c54bbe968e1cb449076b8997288e140d7a7edabba7e1c5a58284d48e38d7a18

SHA512
93da1126703e98298a983f2575ba4d3e743747f1247b9688ee2b24b04e0aa0b2ecbd1a5071532a5b1eec1ae3c7cd5ec2baa8ce643192ed619a4c914b444ea5ab

Download Submit