hxxps://download2446[.]mediafire[.]com/s0ygbuyg4gug0dDOI4R76B9xo52qWEdXEm85InxN0h5pTZQ59sO9JNHZ7XCqITu-T1F2t1U5qlIa5M5MEulEZKGsBp_PzE_uE7lDelLSyAk4wa8xbV5zViApgpTYJD-ay9d7-kbt6annB5Z-CsfSriNr2OLV6k9PlA056XQiDhY/w45nb8g36jlhtyq/Cheat+Engine+7[.]5+Clean[.]zip

Analysis

max time kernel
600s
max time network
605s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download2446.mediafire.com/s0ygbuyg4gug0dDOI4R76B9xo52qWEdXEm85InxN0h5pTZQ59sO9JNHZ7XCqITu-T1F2t1U5qlIa5M5MEulEZKGsBp_PzE_uE7lDelLSyAk4wa8xbV5zViApgpTYJD-ay9d7-kbt6annB5Z-CsfSriNr2OLV6k9PlA056XQiDhY/w45nb8g36jlhtyq/Cheat+Engine+7.5+Clean.zip

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
2308	msedge.exe
2308	msedge.exe
1724	identity_helper.exe
1724	identity_helper.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1072	2308	msedge.exe	74
PID 2308 wrote to memory of 1072	2308	msedge.exe	74
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 2484	2308	msedge.exe	85
PID 2308 wrote to memory of 940	2308	msedge.exe	86
PID 2308 wrote to memory of 940	2308	msedge.exe	86
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87
PID 2308 wrote to memory of 4696	2308	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download2446.mediafire.com/s0ygbuyg4gug0dDOI4R76B9xo52qWEdXEm85InxN0h5pTZQ59sO9JNHZ7XCqITu-T1F2t1U5qlIa5M5MEulEZKGsBp_PzE_uE7lDelLSyAk4wa8xbV5zViApgpTYJD-ay9d7-kbt6annB5Z-CsfSriNr2OLV6k9PlA056XQiDhY/w45nb8g36jlhtyq/Cheat+Engine+7.5+Clean.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5d3b46f8,0x7fff5d3b4708,0x7fff5d3b4718
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9116407139153067352,16528012113382223016,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a90f35a310b8c8e82599500603573505

SHA1
f2191b042433ac15c0e106838d4275d63cb0a2e7

SHA256
53f2736ebb981d0c737f320c673da630e0603e86a908edca43b5d459cda2134b

SHA512
347e9f070cb463a6961cc675a8302cd954fb0259e8476d04746d283f0e30a9d4b5a64a2caa248b5d80b07f49728bcfb50069adb40e361e50e10e0efa49cd496a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
02b3215fb35f057d37c60f09571582a0

SHA1
47082e59e33fe939e8f90644e4932f6ed7afc167

SHA256
9a05180a3bc458c07e08af5f9251dddd679348269603477e9915272aadc536df

SHA512
b9dc601feecfa32cc305578f5766b43b92cb568efb02bd42a82442aa30200c8cb8966bbf1946f3d07204a7a7ed09f633efcf5f3b1568ac29f908ea16078243b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7af5d933ec1cf5ddf35ae96a10baddb4

SHA1
3d1800ed40476850b66a039ef78fd70bf7d197e0

SHA256
590ac9c8f1b78a2744ea88cb46fc27a140a9addf39858cb201e777550924e8fa

SHA512
4f575f9d9c9d76774c4b882ea0a4c760dda989fc8fbe41fddb480ad3a71ac5955b08de85918e815fb2ad0f4ea914464542ee9c3e5a5aba18239e205dbc7b7a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5a2851d4ad730c50a2cd695af319a18

SHA1
1a803a581c4d49fb648ba93c7632f574061bcf07

SHA256
f04e723d23ad53f57224efbcf164fb11ce989d1388349687a7648d44cdf4a950

SHA512
3def7ba3e1aaa3718c293d6e70534c4a6d2a325aed69b8534e2ec6d0c1971f78d6086176687ef42144239500e9d8ba5c5c7d3c85599f96f3869cdd1c372f74a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
441d7e7dd6a1d153320063ce2c9c4644

SHA1
765de2204c928fa2db8e9061d445ba3deb3dcc7c

SHA256
61ef8366215727139f1da3e63a9976ce1264790fb4a1e44e437730abc9950b1f

SHA512
bfbef5c019b73e4cd3a4b9ea184df7e9a6f5824cd0d5110975c67b222e40a9ff2894a9f287278830617011527b6bc8679e882145964a80505e7149122fdc1368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f1881400134252667af6731236741098

SHA1
6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458

SHA256
d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75

SHA512
18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
52081972b319c8c13a3fff1ea7c40ea5

SHA1
7e1aa5a8cfd1d192502c4ad6710d1a560d435c34

SHA256
866db8313d81ba2779487b3deb520f63bf16b069eaea698fb4d7748ea3676318

SHA512
890714df17e5738b159a0a53c0397f52d646b0201fcf8ed7f63cc573d87c83553039d9c3abee04f70c8c849f2469451ca42f64b88fdd653d2468cc0bfd99fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583d33.TMP

Filesize
871B

MD5
4540d10ea142b9507c404ba253f14489

SHA1
e6d14ae8565ce309d21ffe06c139afb5ec8f4d0a

SHA256
8a527455795326a41684769699571cb2551b259c74f06db799ef9f6ca7e8a9e2

SHA512
3e651a859db124ae2af198a9a9b616700e7a5b46789f347fadc9c0ea63a5a99a33b601aab4682a7f3aa93002625a47b97cdcc84f61802aeb5df1511517478534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9931532d0431ad0fb92ff304e20f8eaa

SHA1
f38e8fb09d9ceb2da1c72abd5165a56a4506ec02

SHA256
aab05337900cf618923db57ede393e0a55e91991d22c076105e5e6f2f276e5bd

SHA512
de74769ead9339692160fa684cfc7bce38437a08b7e0bdca840330aca7157e706a4de1a4d4cd15360087773017fba9e5fb3a9cc0153c1809653a90bc8439bba2

Download Submit