4107cc7c0473fe9a9b674c399e7f4e5f319367b61745105ed0a29b1472c50c7a

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2023 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

www.3dmgame.com.url
Size

122B
MD5

49cbfed4fa9b3fafdc9d499b6163fa62
SHA1

28decd9138bd3f7b3ef38bf9e40cd0d6305d1cdb
SHA256

03df27e82600098c34c413cc2e45b43638d3ac33666960cfbd913f1c3f9a0b11
SHA512

64e91ed564ef64d7687599012c4728b811fec2661dcb7941374cdd3a8450563073c67c452d97d43545f49182fbda2c26702dd35088723ace21717282d1233627

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4608	msedge.exe
4608	msedge.exe
1984	identity_helper.exe
1984	identity_helper.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4608	2316	rundll32.exe	81
PID 2316 wrote to memory of 4608	2316	rundll32.exe	81
PID 4608 wrote to memory of 2044	4608	msedge.exe	83
PID 4608 wrote to memory of 2044	4608	msedge.exe	83
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 2800	4608	msedge.exe	84
PID 4608 wrote to memory of 4324	4608	msedge.exe	85
PID 4608 wrote to memory of 4324	4608	msedge.exe	85
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87
PID 4608 wrote to memory of 4512	4608	msedge.exe	87

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\www.3dmgame.com.url
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.3dmgame.com/
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb0b2546f8,0x7ffb0b254708,0x7ffb0b254718
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
    3⤵
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1915258349770911433,8848219435791182478,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
43ecae1563d4a9e31c08bb9cbc47ecb3

SHA1
fe8551234d032468152f0a0ba893739ae2e75cb8

SHA256
c315f24c80ece793db3d2ca67b0b21e25ac8d03200c9a348096cfa3d8c2e906e

SHA512
18b15e0af4c71f836dfe51e6e0e59165357631171934a64bfa5eea5666cdb165d61f7f18f881bef35a06919ab56f8cb0016ce956821822dc9750de5ba19b0645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
990B

MD5
29daabc566e66f6e55bbcc08a4c26c7b

SHA1
21fba23f5633bd0583743eb5394ff77c2c038a7b

SHA256
1bef05e88f9fe20dd7331512a6419b3dbd0e2674bd493ff5e14f655867e40b19

SHA512
d74557ad616ea61e0cfc4c72738cfc2decaf43a7119f739ccde3872a4bba7cbaec118cb7c675746e79b178b673b4ad3ba46232a0af09b1fc9ef99b6f97b5d7a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
936623b60f3791289710c8286b65a8df

SHA1
5ee1f6db3d6d8d39956d3d4c4cec37c0d5ea72e5

SHA256
26c739e684fda81009ea1f6b80d5ef04828b7fbdf594d4e73189c39625579559

SHA512
054b3422ec6e679989155b6f50af7f24eb3700346a0807fbc071337df9835d37c284804e7efeecc4734d6366e7f70f88126d02819303613b7fc275a62ffaa676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6902443d52e99247d2de27802c6ad1a5

SHA1
c9120809c131641c240fee62b80840c24eead31a

SHA256
2678bba94655c3184e14a5f545f107dbb4b398cbd49426ba6d85f5c26362de1e

SHA512
9187a85bd39c8fb866fccb4d59963133f09bbcba3e54de13112f000a3c7dbcd6da3d02e33ab50f9cff778b1a54f65e442cd815d5d437ef843c491d112be44a95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e26be9ce0f929ad129721b47eab1d5f9

SHA1
cf3c6d3e3468c93db0d6bf95e7405b8cf293fda7

SHA256
b2eccb88fd5d5d229dcd87b1ed2be124418f9a7cba39341b4144ea41eefd6c5b

SHA512
4291b2e0a3e3e3a2ceae1f5faf0086c048f293bbb35997eb145ee533efd56b93a0e73558bb1197405462831dce6785cef472c14f1b5a9dcb8f9e20b38873ce67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bdf7a85ca17829695f4c88831cef8b2d

SHA1
7f09b623bf024a878ccd41040a2192e9f611315e

SHA256
c1efe18a15161197e823f79936ef9558c670bb000829df34ea7ee7aec9aa4862

SHA512
e0448e1f70c61868cbb9b6bbecc5830cc78f3dd0a62179c64cc27a1fdda9c4128c11ceb80a0090fb3d87051592601829dc57d7b3681271f5d28b5148a85babc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3d952e43ee32bf70a2da164b32bef023

SHA1
16ff7619885520caa5fc31429f0b281657179dd2

SHA256
73c1e69274843939bdfa975a45779173f5fe7c5066eedefee25f94739ae9ca83

SHA512
80c3641b950b6f818d51eae61ce7a38895d3336599f44177aa3b68966272080c33657cd3b109e1ce52bb7e8c3f52b17a18a6886bebf594c4f692437bf6f3cc58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
541c2c5d30e756bf5f433a2216bb777a

SHA1
7d30bfaa9bdd795b68e7da65d2b82efe28070cbd

SHA256
22b739a895e6af168b3552e3577d756768d782919f258cfd491880761f7fff3a

SHA512
3c86dd9ec5d7fc5385199f2ecf01da6fb3bedb4f296c482e64ce8c36e25e5d052b6d05f23af82de8e7d0538d5eff1ea1e679d444859b12e14c54581a2a1e7ac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585f90.TMP

Filesize
871B

MD5
7aed9f576b138542d55be02be8e89455

SHA1
cac611736885e8d8d414e1d1cacd5d483c005a22

SHA256
cd464bf6107abdd5815dd9e6691d25acb7f57a4cbf8e45a9ec08c546f84eca62

SHA512
8125a79a7fdd8e0b5010308bd77a36ee7eee7a1b871e57a352eb33e6d9dd17954125c83a4c357201e9949bcc8df1161f9b9e34f7cc7b6fde9d8384a547c7a084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fafa1b4a8b64c9e72486f9d67a36b8cf

SHA1
b4ca749410edadae9ff05dc92b3ddac53447c32f

SHA256
7ba65f9632db99fe78a12f5ef95aaddc3c4deea19c8777efb0ee7b343cdf688c

SHA512
c65beabdce3cbc0a3d500480a13bad472e8c2069837581ae3419bff798c037faa677d2aa11779aa6b010f1b925b6cde88b04cf030b54fae9271201d155e71d67

Download Submit