7e35f6d006dab99314682d240622f389d8139905de12c377edf4df8de60eb437

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

www.3dmgame.com.url
Size

122B
MD5

49cbfed4fa9b3fafdc9d499b6163fa62
SHA1

28decd9138bd3f7b3ef38bf9e40cd0d6305d1cdb
SHA256

03df27e82600098c34c413cc2e45b43638d3ac33666960cfbd913f1c3f9a0b11
SHA512

64e91ed564ef64d7687599012c4728b811fec2661dcb7941374cdd3a8450563073c67c452d97d43545f49182fbda2c26702dd35088723ace21717282d1233627

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
464	msedge.exe
464	msedge.exe
2116	identity_helper.exe
2116	identity_helper.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 464	2920	rundll32.exe	85
PID 2920 wrote to memory of 464	2920	rundll32.exe	85
PID 464 wrote to memory of 4244	464	msedge.exe	87
PID 464 wrote to memory of 4244	464	msedge.exe	87
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4896	464	msedge.exe	90
PID 464 wrote to memory of 4440	464	msedge.exe	92
PID 464 wrote to memory of 4440	464	msedge.exe	92
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91
PID 464 wrote to memory of 5000	464	msedge.exe	91

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\www.3dmgame.com.url
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.3dmgame.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f62b46f8,0x7ff9f62b4708,0x7ff9f62b4718
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3022934811705991336,16159256778277495249,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
483924abaaa7ce1345acd8547cfe77f4

SHA1
4190d880b95d9506385087d6c2f5434f0e9f63e8

SHA256
9a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684

SHA512
e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
652d3c145ba05f972ef23a858a58d91c

SHA1
e85072531aadc0a58cc15042a50f41c5aa1325e4

SHA256
5ac044ba9707443f2d133505ddcc0e8e09279141e3d81ffad392ac65a836f364

SHA512
347532b49c15e3de6e7868de181348e72a862f73b3f7064cdf079b59a40a1e160ca2b8c212188b7ca52c7b2c01470edc56438e429a7de2e307a25a3aa2eec99b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
919B

MD5
ee20190b881c46dad2426f1298344404

SHA1
eb69c8f07cb390895d44168c1b5f29a3a7fab470

SHA256
e7f04f1aa001e1c33f0f5e08ca1675b1cfaf0c5c9b9de7c95daf8e4a3c9ec8c0

SHA512
01668ea4550fb8bb7e89a83aa864e315424f9e76131407a49d9cba3b8cb838625fc9a7baa64d4f97e7d3adb9c0f031c91e7965330bddfebb5aafbd0abdec4f4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d66af3d9ade6840f67969133e8be0b66

SHA1
a20090b82a62c1859ed3cbcc7e3c79fc5e31c8a3

SHA256
39bd0084ca54a1837d7206e8e3bf785f32f3adb208e4e49f1c273f057cdd05d4

SHA512
77afee77e200bd1b293d7a052880822906e485b46cba3e256e506a403c35103d2a0df569968aa8433742941bce47e6f98c1a58150f6b2bd6ef805a689cdc8650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fa2a60f69c3a9e613f4bf7c287fcede7

SHA1
5902357cb3a2c800365a9ac31fba0747bbe245cc

SHA256
4be99d1aff88147ef24902d96e2d3da7a6d98b064021f4e2c2cbbc67eb75ed97

SHA512
290a1cf9bdfb81fbb02611d48ee6dd2526d90fac4aa6763a1a90e8feb5e909b4d8f621542646bb37529a6f0b7b96f26773a27c4e3377a68bd91595e921e9eb59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e826f36977965e8a465260f1e587c387

SHA1
e02b109dd78554c4fdca856b00349add11352718

SHA256
811d3c24e5d041c14e355525084b4192ff1eb319e673ae14dd1846c4f01be1f6

SHA512
1344a0f3d3e6b6493ce2ec4a592a0ec7746e714e602af42ece4b543ded68ce7f96898cbd8e9f34ace1190f93a91c54ed072037ac9f12646a30cc5fd682d40133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bad07bf3dba3d324f3c60aef8c169194

SHA1
6c75a69639fc9684f7ec40a0b1fa267d47639fa2

SHA256
ac91a8e4454a7d525ccd2244109e8de92567cb4cb80a13814e9a9081cab83594

SHA512
2878865a9632f8ffeb3c3f1d8b153f58cb5613d490745cb2e81433b499a117501150c94cbddce06719366156c7e2ff42d8fb27392b4b49965f9c6744fa417c7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1c706d53e85fb5321a8396d197051531

SHA1
0d92aa8524fb1d47e7ee5d614e58a398c06141a4

SHA256
80c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932

SHA512
d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
137bad67aab99426ccd3ddaf46ae270e

SHA1
a5da501dc910d575e6138e65eab0008d42084d4c

SHA256
94077023b9a950315ae4c64a02e64cd9639f372057cd214a26a242b66d5b806a

SHA512
ce5dacac976ff76b9eea5c2acd1ef4c7f5e7c5a0600150488ef06ab2d1ba0bc736fa32bad32dc5fa17757a4521f8daeb55b9f1240210bc62d9a9fda70aef7618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4ad63f6900f2f564ee6b7a8f8ef77a24

SHA1
74963741d5189b7111a4f05d9fc6e11615114c5b

SHA256
67561c499ed715f043997720dc3d3d6a53f71aac0484ea0a4931bba8810339d3

SHA512
d311dd6a15143a258447ac15387e11717bbee682f11ab1332dc9b26b38e92dfdd1f9a4e76a758c31ac01187e84f303fc41d51e47cb76af2789f491d22db99389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fb01fc3bd8d8936ddde5af684153fda2

SHA1
4d6f18b940013b28f9e78e6aae97d1986dbd97f9

SHA256
648e51130833291f97b30f12c83aa865fab54b759eb30bb89e362dd09ea6d3c9

SHA512
c1ff3da3f7660f80c095595f3bdf91ef9fabe8aeb0a60725ef1ba9cc0cbfd8a2194720095e50f28ca3549c62b022f5329f42756013a8c83a3d63dfc3008799cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
3f733271100f1f0334c1bd7902e37662

SHA1
c7861d1992ba56f6c5bad97535c804f1291780f4

SHA256
e9fe44636d0633f3557410625c07e6b76421f11073c56848883c0f806c85634d

SHA512
35a7b683fe0d9893c66d97e52fe18532326af3755ff111940d485aed005a11344646acc8fc67d1567c4432529a2b77f51a2bc3051d1997864f211ec921b11373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5801ff.TMP

Filesize
203B

MD5
0f693311253ea28e44d46dc42541ffbf

SHA1
63744cc11c3afbfa805ba89825dae3c25a8f47b4

SHA256
f20a06a0e2fae4af2b03ad9297a5578b54fa38ba00f4f3861c04c19bdf1ce42a

SHA512
524b47a4f46b71857fcbbd1bf3337881a6b5468dcd63cc834786e2b53a0a57b603d7e220fc2d874fede51dffa82051d84d67c094fcc13548f8a7136f5530bb7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bec32fa0985025789f86c3b553b05e37

SHA1
ff1d9ccf06fc717cd93544a39b1a58ae96e5edd1

SHA256
356d8d3253fc9e812e4ec26e199ed54e07ef075e6e61be84e6d38241a11ae913

SHA512
784f339cd37087403378c0f9da551a85d3fd498a158bac0b08bd72c096b96de3b236eb28417f1b2fd15dbe807c81b2e172d100e2dbe682e70c1b1c67222d8974

Download Submit