abf6bf6bf867d15add9db7f2456a2e4a1f76956b4b6dce56db2dbc58d7e9d87b

Resubmissions

19-09-2024 07:04

240919-hwbn8swgrl 3

19-09-2024 06:57

240919-hqxdrawfjl 4

Analysis

max time kernel
143s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19-09-2024 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

msgBox i see you.vbs
Size

47B
MD5

7a489e582589c12308c301d0e3ae62be
SHA1

e0c53f910a55e67bc27ab346e0123e02ddf1ae2d
SHA256

abf6bf6bf867d15add9db7f2456a2e4a1f76956b4b6dce56db2dbc58d7e9d87b
SHA512

6ac97100df571363c563d373067823911d5f1b7fca59a486f805ce5cfc6e92611ac736faa5cb5beaff48783abad0df461371cf51f9f6cf561b1ee55eb478ead1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4324	msedge.exe
1416	msedge.exe
1416	msedge.exe
4324	msedge.exe
2152	msedge.exe
2152	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 3596	1416	msedge.exe	89
PID 1416 wrote to memory of 3596	1416	msedge.exe	89
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4132	1416	msedge.exe	90
PID 1416 wrote to memory of 4324	1416	msedge.exe	91
PID 1416 wrote to memory of 4324	1416	msedge.exe	91
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92
PID 1416 wrote to memory of 4844	1416	msedge.exe	92

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msgBox i see you.vbs"
1⤵
PID:2028

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1984

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff4b7b3cb8,0x7fff4b7b3cc8,0x7fff4b7b3cd8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,17922392821828066022,13906367750281934771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f2d5d4288d9f2f69732951cc25166bf3

SHA1
c5d59a8d238e6c66dd45b12beed859965bc31910

SHA256
24d92e0d9000f47361e210aa2bca5bd72ed57f2c38913d59dee9ddecf1cbe261

SHA512
17ee3394fcc5afd82e6cf91d4903cd13a91f36b4737f838e82465d03cb33fb0bf7c45c8fcf3dbaf7fa2ee2fd7c886cea917ef03a54a0cea8a6e0dff2cd688155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ec5cee38910a2bcc9b4ee2e3b925167f

SHA1
fe02422a46133d261265175d13adf9f9996becaa

SHA256
3c62768f27bb554cf9673eb05d75fd0263e85276314e30f913ee42b07df4b4aa

SHA512
99f7b64c225ec02336ba1013663733daf1387aca70dbf3175ac0d4eac6c00a37fdfae0aed5372dd6b102a46a2fd84d70ba737c80e0b83e27f092865d896af8bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
319B

MD5
e8bef7d2b595bc30111f359ef7efbe77

SHA1
ce1dd283987d14c468bed46e581650a4333166ac

SHA256
edf0f05eccd646d714c7380848e7fab7982ae248fbf46df475accc6ce760c843

SHA512
480046352c66c6a5110ece640b90406755db2e9fe9ab31b6d5ff254bec9d119cf5fbd6e1d2dbfbcc4256ad2bc87342d2c5e4b9c1623c77c8a2b8e344cc926bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a2a7ce36a83c15938c95c3a930c26cd

SHA1
77b08603e64b47a39b6636dff2e16b5e8a8ae95f

SHA256
bb4a3e66e2cedcfece46dfc63f420b1876efdc11eb1e4479964683925ad98820

SHA512
d4ea235c4108fd26988915c10dfb5b0fabcc2a7c6d4edd40a02e7896f122c9dcd6f96e6695ef885d778408649091a3004d5ab4ce61a10042a23dff555f06df91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a2b86d6fb4d04774e05bc225166bec5

SHA1
dd4eb3852f02086550f91126b23f1d2a7a14321d

SHA256
5b779e8711a9c41c9f46234318f5e25770ff3828702a84fa0cca6e609923eda9

SHA512
baacbe3f7b1ef4d78ae5b2bfbe6b6170f7976cf12c053db83845247bcd6e55c019cdc45429e59a1c0774b1f43d452dd73cfb57621637dd4f28983b4d2656ca2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3cdf75bf304d4629933eb50354ad1780

SHA1
57c1a255c9fa1fbfff7af40d1e006a726d87f8ca

SHA256
3484a4f8aac91feea87436f7820ed6a4be20cfef34e76880d77eb1c310f7f6df

SHA512
9799c0e815fb30013c299a4ef4b3d90c037fd1e3e920a83b54175ba4c5b6b44a452edd18570dd83d46cde73359387817dd15c4e400462d16b91f9e0aab869c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aeaf94c2ca4b8f692bdfa5563740a741

SHA1
503c6c3329316f1968ebcdf34c1fad9de138a3f6

SHA256
05b5acc3f936cce60ac075b5278f010eca182a96677ba342863db223136f3b4b

SHA512
63f4c3fd0e9da8d2c2e087379870ba690d03ecf669643a6921d7cbbb14f6ad9294aff64c59816a588a6a66579c51e0d8beb147d58c0cef01be4502d42b7ae03f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d4469b60a079bc7e756bbb82d5f9077f

SHA1
4eb81838830b7e4e35220649f08c8b854b6eca2a

SHA256
ed1d7138e77a0e0f6c6c7f0c88dea75928ddcf29e2713bc856b7aa75b306aa85

SHA512
20ff95ee587a83e71c0d753753c693383ee248668144163ee57dc67c3724b74f74750c89c206cca3472eb4f45e76a334023658a13241185624e4e2140b5ffaa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63283153b4175fda77666860c3c312fa

SHA1
c993499166dd686bc71defe21087ded4054d526b

SHA256
e1cec35aeb74ef1d3b269efae7eb55e7d5032db7083fb641ecdfcf485bc8f409

SHA512
e66f2231e06ad1b82847a9218531073aa38a543ca0aa055d32c7b3ecf69ce340eb9683723bc0e6ee44e3dd48ec77223d6c92d134e0bfb959773433d050b14ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
39e0ca81276b2575e22be203d33e821f

SHA1
f7b8a10fc578e4cdc361719261758464f99f9ca1

SHA256
13128c2b0012f9d75644356a5224d1679d7c1357c8b5b8e66a6237a760e7895e

SHA512
a25de3715e979a24e1121d9944a6abd68b77687389ef30e4323234f03187377cccead098b9eb118a626575744a53902da82b6456edc2850b3a853fb2ef079e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59c49e.TMP

Filesize
538B

MD5
ec04c4c3714b51f9ed39fadbd1fb3e13

SHA1
32a3a8e39793647a18395c32963397c54f34c933

SHA256
e657e3864e65291c245bc00150968f3037b903397e2e365e5d5573aab2bfe54e

SHA512
11fac72403f28287d8152492205be72d225986780957a36d218bd9fb1e2569e39d0e24a4722b5d69faf098bbfd5e807eef3edad5db42ff9484de10245bc907b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ac0bdbb19f7d48a8430af3a1677e7065

SHA1
928819a5e7963263f874a83bffb15ac6bb844a11

SHA256
0bd07855ad1bb266373266d5cf2af6746df723cdfb262c6480f4bc502a040cc0

SHA512
1f124bf946b863a3f92511b1ac09882d21bb364d1c41b0dbf8f312ad5bae02d0f764211824ea870985c77f28304058eef854dbac4dc0c883686861a5c4f51a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc6258d6fa61f897406fdc9c4fd315b3

SHA1
077f974aed230bbfb33c984aa8635e4b9fe29295

SHA256
7cd13fe3351550a451b31d1d73c21012793b245ccb1e5e7316c1a91764eb1d80

SHA512
5eed1987f1c82d1327110962cdf1316e0f6fffc3937a55e53504d4c825c7cf3eedeb9b405f4b27c11bd7f400bc30395ca11f9184420b508e2b360c2bfb82953a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f223211e13be72be185082039d05d533

SHA1
6ba8373ba637d96d0ec23ec10cc59fab6d3369c2

SHA256
e936aaee01c11ef04d14fe6d6609d20378a948fda9ff8c2ae7d1c4ef871eb964

SHA512
6261a4ad625cb9de654200ab4742c6d4885c45a4275fc80d42cd5ce979096ac04e759cffa9c03bf0d9049841e469f45a514ac45a07ba056c48f325faa15dded8

Download Submit