hxxps://store[.]steampowered[.]com/app/1840/Source_Filmmaker/

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://store.steampowered.com/app/1840/Source_Filmmaker/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 33655.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
2516	msedge.exe
2516	msedge.exe
800	identity_helper.exe
800	identity_helper.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1916	2516	msedge.exe	84
PID 2516 wrote to memory of 1916	2516	msedge.exe	84
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4052	2516	msedge.exe	86
PID 2516 wrote to memory of 4908	2516	msedge.exe	85
PID 2516 wrote to memory of 4908	2516	msedge.exe	85
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87
PID 2516 wrote to memory of 3424	2516	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/app/1840/Source_Filmmaker/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf2d546f8,0x7ffbf2d54708,0x7ffbf2d54718
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8749061493679874253,17615022503717961170,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e77545b7e1c504b2f5ce7c5cc2ce1fe

SHA1
d81a6af13cf31fa410b85471e4509124ebeaff7e

SHA256
cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11

SHA512
cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6e8a447faade0951053115287e8a9616

SHA1
b5361b7702ab1ffc951c6ce275cf1990e15ddc54

SHA256
46d50162a13735a5c10cd69e2ae12e08e442f491bf2f5f49d94223312cc12643

SHA512
6d985621fecd982fac2e005d51bf8d4c013cb4a62dff1ddd3b3509e73d7893eec8ed8cca349a322d508cb4d48d3c2704784b76930b2f067dc630b8a0fca2add4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
54212cb085e0e54334c2d19cf50a365d

SHA1
77e6891758ca6ceab1aeaa43d1d6802942df41c8

SHA256
7297871e61a9039f8d75545a84b1379402d2bd983f03ba180b2c23da13368ed7

SHA512
7fb068f2ee548b064f15d65fd0f749ae3c762cc15d62e4b1c21e3f97d24eed93f0b3ed3e48ed706592c1d4f2d229b01ca1946604bc91ff3457525c55ffd72a10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
741cf5d1b822857e7025a6292c50371e

SHA1
8aeb15a5b4eec722caeb8c49100f08abce46c9f7

SHA256
972eef3ecb7b1d9561ff1adf4809a657ebc3bb91a28c32473e41e1f0f0bb96d0

SHA512
0072afae60e9526cca468be83b0f65e361fa30a00e44bdd595510313dd433235414493272d90a6527b65429c526af33e652d8a269756a33b810150b57993f18d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd401a4eb6a2c2904d1352b59cd73bc5

SHA1
9d5fabfc6d03a4a9bc04437554c7a3928607d69e

SHA256
9f8257cf38a134e5f314d0526b8090aa439c399826a5e5bfb0626107b5ade699

SHA512
1b7ba93fbb6f0f6732a580556aa4e93bf847da3f22efd7cd8c080750d020da813a2565a4d04ab28768f7bf9620dbbb387118eefbc4d627f3e5583e77fdef01cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1b5249ff128fc3da436441d55843273

SHA1
8431e7c86e10fd279bc8aabe02e07037568466ac

SHA256
a9d8a03240e2916e23d399c88f3f2ecf778b417e379085315cd79cdd0aa7e453

SHA512
246be97e8992abcd49381b54cc610812275a82df58caa3a4a5cf1ed9519fd9c939cd9988e5a9ea936a8750a1d1187de7c8e547e95e249078f179fe05f73a6103

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6db2d2ceb22a030bd1caa72b32cfbf98

SHA1
fe50f35e60f88624a28b93b8a76be1377957618b

SHA256
7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4

SHA512
d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
ce895728b9304ebdc94a5050815be6be

SHA1
56c62604de398e2b1ed294e735d589c15e374952

SHA256
fd206005c9f495c7dd15db3f966fe6943b2bef17d3bc2cf4b8e4b472462e9ad1

SHA512
af611da3570e975ed9102bd01ebe098048d0d9255011b1340a36af2716c593d35d01d5a53541cecd26c04e85684d30ebd6c8511ccb2a1538fdc23e37a2ab344d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b68e.TMP

Filesize
539B

MD5
9a8d3c25457ee14958af4be6ec7c0947

SHA1
072247526938cc5ea0581c8f07abaff77194259a

SHA256
3c0b9188c62b87449c02ed079d9dedd94a85424b0c1c088fb0e5f8bb7b0b1469

SHA512
d410802bb6ad34a20597da9249d45d29742a4cef06c58d6a6e7d8475cb5469e3f0c1da4b3943611e284e03ed29fa64011aef64a354402b291f7e6c6b40cf5805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b52010ac6e330b65ed8d658305728c8c

SHA1
30f3d05ae804c0d79f7c5ffb486974822a1f2a40

SHA256
1e1e26a46793500e6d71be512fb0b1dd77932a552395e1c85715d0743904c8a5

SHA512
3e12aad06cf357563d7989fcad0c1219c990d4957896e3002c6979ae8f61ea0a546bd19f7baee2165e45872094b751ed687b98597ae3d3eac4b27726d6859709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e5387a8351f60e685f8ac6fe60f6d9a6

SHA1
97f313b43827b9f6d60ea56826d00012e57fb27a

SHA256
255f7ab8a55e180000133ba012121cf02b5f1acb968767e6daa3307b0d1152e3

SHA512
259ef706586f48229ececcde21a9aa9e0ebdadd3fb19e98a605ca93e6edb02c800b057c97fc7b71a23f669c544e87f77dfe0f3eab88e32adb67fbc3c5c278509

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 33655.crdownload

Filesize
2.2MB

MD5
70f3bc193dfa56b78f3e6e4f800f701f

SHA1
1e5598f2de49fed2e81f3dd8630c7346a2b89487

SHA256
3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

SHA512
3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1

Download Submit