33631b4ed3627c8b80759baa45e75ca3a84aa60f85a1136a81b04b5cb7911bd6

Analysis

max time kernel
156s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mtasa_maetro-1.6.exe
Size

100.0MB
MD5

b2bc77e94163659098edc6840072cb53
SHA1

754f997c0d6858fdeb516d07eaa516daa2af5d3c
SHA256

33631b4ed3627c8b80759baa45e75ca3a84aa60f85a1136a81b04b5cb7911bd6
SHA512

b7183bd3c6daef4c9cd6a34d4172bc664f5de7d53cba9ec6d93ba10ccd2cd02bd9630a7b53519ddb208d82af230a3b2110037784bad0a4054d01b55550e10a6b
SSDEEP

3145728:graz/ScSMDkcx7PVBrIG5ziYidukvlSpf:gWUGpEuOlS

Score

4^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1460	mtasa_maetro-1.6.exe
1460	mtasa_maetro-1.6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
1956	msedge.exe
1956	msedge.exe
2084	identity_helper.exe
2084	identity_helper.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1956	1460	mtasa_maetro-1.6.exe	90
PID 1460 wrote to memory of 1956	1460	mtasa_maetro-1.6.exe	90
PID 1956 wrote to memory of 2576	1956	msedge.exe	91
PID 1956 wrote to memory of 2576	1956	msedge.exe	91
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 1720	1956	msedge.exe	94
PID 1956 wrote to memory of 2052	1956	msedge.exe	95
PID 1956 wrote to memory of 2052	1956	msedge.exe	95
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96
PID 1956 wrote to memory of 1880	1956	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\mtasa_maetro-1.6.exe
"C:\Users\Admin\AppData\Local\Temp\mtasa_maetro-1.6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://multitheftauto.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff8159146f8,0x7ff815914708,0x7ff815914718
    3⤵
    PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:112
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6890969511162033204,4847883634530718842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4060 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
1290bb655826e250b7a9d061cbcf56e1

SHA1
4684be0478aac384f61be09b6c2c0e96a3ebd254

SHA256
8d28d83ad959a6c780190fca9b04fcbebef5fb29911aac5d2b00f6a55881cc35

SHA512
2daf3ac9c77e93a81859913d054d153d7371204651315e4d1645e3b20e6172e98d9b425bb97bd5bdca365294afb9bb8f5da6a67d6a6a142acf3b3ff42a16f2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
482B

MD5
298a277caa0e2cf656a39d2b23944a19

SHA1
4a660e171d111b27368227823a7175d42b0cfc28

SHA256
b231841c94a82e4af0b96cbe89bb9186300c0a831a3d4dc0de616ba6e0a6be41

SHA512
199c359164deb88f10b7cbe4362555d260323fd2c3c8becbefdb2d3ffe1f7f34ee004c78d565ed9e73dd790bd7e9ad56b708cdaff8e35224c6260e7aa4961fd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9debd1e4a488b2373d074c92a6477abf

SHA1
a85685774ac525c080c19a59ecd2f46d22773d18

SHA256
df1f8745554e3b983a7eef9d593d6c5b46aba7f1c5040f8a0c61b74a9192d69f

SHA512
efad055a423cff293cfa382f1962c67d9b544a28d2a227caa8c847a03ac5cccb2eab917609712457306edefa06cd39def3252d98a10e59b4c271545b8f252a23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3ed287a1c1714843eb9958f8b008ffa5

SHA1
495ad3cd32bd64b343fa6e1053f99fac9a4242ae

SHA256
c6b38a90113c0728e93f9a8efbe9bd952bde214081438deedc7daf26c13f33e1

SHA512
bcc8129d9361678f04abbc18db2aebd106f388b1617073b068213966283463821c127488cebb1100915b92855230853347b1ed9faa8979832efea99404dba91c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fbeaa52ba1911e41f24dd23060f6cf80

SHA1
a95f7d16e6ea37ee41ebebbc496bd99b4f80f805

SHA256
5895f88d7ce7cb8a520e4c65a62229c2c9a794c401a6ad63a7c677c2f4451bfb

SHA512
4ce48a082b4599c9a74076318cb36182312af8e216324fb01d28e26c513a08cc87c29ae86258e2a1eebb327f010e87bada77507acea91903439b6cf21c2aba2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
964671f8d3eaca9e3920a29270f37415

SHA1
bc0d1f576e194f5a3494fbd1c977aba8307dc8af

SHA256
f487e526edf875de8b49bf88dd49481fc9653ef13bacacb5452a68f799d1eb40

SHA512
6432cafb0fea91de74a938e712f911fa1fa2470286e64e02ea5058d8014decbf86bb5b0a5b686ef2afcf7a85a5de41166bd5374dd7cb52006ff4a6ea786e99f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
6ca238631357a08d52465f44f0ee22d6

SHA1
fd1e0879382c16fb2f6e423c4ae77aeec3cd6c14

SHA256
58ba0cda0c05af03b3cba96d3e3e1b4c418ebedc7987861e909b484cb622faaa

SHA512
d2ec0e00a2e2c46cfb64497a43e711aee627454d423eb51d0a54d28b196b5ca8ed34bd9bb182793c0f612860d4528b0e135c6e624887a22bcc56269ff24092e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585dcb.TMP

Filesize
371B

MD5
3cac7713d7f4a88a8788ded047fdfe8b

SHA1
f3199ed0917d761b0bfdd325903e253d66a6c42d

SHA256
bb6195254521567882c8ba6cc100328b690c6e6faa43ff8104f6d7dd5249f41d

SHA512
5d9957f010b02bb704bdbe2d0db3a82c99986a1a6fd2f31dd1dd53e4e12a766fd0e63ff7f706f158be19e8604d03757b462c54a90d6a1dd22d3cab5b662a9f05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ce6eda8b76b35178396ad7d017c77a2

SHA1
09a739340a5cd60c87d0e715cca97cf83dffa0ee

SHA256
31915d025c695aeb6d10a86cc5489a4f57d31a97282ce728f7cfe0f35217926e

SHA512
66eeedd284b479831ba56bd56e15f660a548ab9a3b501f44048fc27799983b9ab69ee3c0d82d25bb6144afd5bfaeffaa1ed0abd6638b894f9837790909c53cbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgE14A.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgE14A.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit