hxxp://radissonbet186[.]com

Analysis

max time kernel
206s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://radissonbet186.com
Sample240529-kwmslsaa94

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
3456	msedge.exe
3456	msedge.exe
6068	identity_helper.exe
6068	identity_helper.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe
5488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4344	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4344	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 2108	3456	msedge.exe	83
PID 3456 wrote to memory of 2108	3456	msedge.exe	83
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 888	3456	msedge.exe	84
PID 3456 wrote to memory of 1072	3456	msedge.exe	85
PID 3456 wrote to memory of 1072	3456	msedge.exe	85
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86
PID 3456 wrote to memory of 1148	3456	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://radissonbet186.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa94c146f8,0x7ffa94c14708,0x7ffa94c14718
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 /prefetch:8
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2320,9632469587685192453,14057734510757303709,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2456 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:760

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c 0x514
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 672B
SHA256 88653ff3e21c1d96a2600cfde697ebb64cd1c147ce3463371035333e9dbc7a3a
MD5 b22dab7ca817981ed9394f34c3f053ef
SHA1 227705116b3fa7352a27d56d00dd9c82893552f7
SHA512 99be677430788e40e882861ff4872542a47a942566fbc464ee9b2570ff9ade2483630d8689fdd73ecf72a9de45f56c44184bd3d6912656f650a5bed3a7f912be
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 587b8d9be2d898ba212f71e02ba4817887d88d5c1edbe84b0408eebb837c88d0
MD5 1d9175f0b7cf7a3c4b1ef757d9007bd5
SHA1 9d86706068e5381b9266cb9702535ac805067e6c
SHA512 6f67f0ff8ddb69b513491ccf04bd545371345661764bca725bea589c66b8db580eac6b73a251cc1215c51f0167da530beb505a0f559fc7ed65c77e1d0416b729
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 477f924985a87bf1561109fadce4bd904e7d4834ea4c6c8330c7ace8bc6a6335
MD5 9e86fb1372fb660bac079e73c346f21f
SHA1 825d7a179f338bc040a7a47918b9ffd2c38d4c00
SHA512 528ba5ee74ea3d9998392fec01493360e7d6130a41df364df46538fec656be602792d210d447ceb3615e0a257e1469ce2845105003872d11c26d87d060b11a90
SSDEEP 96:nCkpL1TFoj0wpvWMoiVmde3uV1jmQmxUWQyV+VDCAiEwb:nCkF/oj0GWMnuVhkrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1c1ba154ef814cc7e9faf0dbb1450dba8dc567430a15e079384f7e455eb50301
MD5 bc9d02ec2c661d63dd9d5e64083a51d5
SHA1 82d8702bc1629de5071f1bd8e196f0d4c7f2b5df
SHA512 2e4a3c5ac10d9800760a2799c0c320a9d681ff6f133ecd2e94cf870561aa739b2f80ff37b7c67a98a9122e118c5f171862ac3bd6201584d83a4dd71d10a66aca
SSDEEP 96:nCkiL1TFoj0wpvWMoiVmdeHmQIxUWQyV+VDCziEwb:nCk8/oj0GWMXaro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 add4ae2952384052efcd8d4fe20ab64e9a885498b32277f0634b406167251842
MD5 1f753a6a0e61350d263010afb2925dfe
SHA1 ee16d43561053eddd86a69a09fd4358cbcbb1e21
SHA512 956ec93485fb4835ec05234c9833cf3c668f8dcaee576b8a06b099525e3e1d1b5e1bda60b46dd9156c421e3e5431b0ff32db87166d007861aa444274c1e56882
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 0701aa1dcee8d1097bb19f12824ded84f30497a77503b39421b384364b6fe73d
MD5 624cce29ebbc5febfefbc244976d4109
SHA1 02475f6198bd9171c2800d673fcc69fcba60b104
SHA512 44c42347e3ba2194f1523fb86d3c7446fd4a5964ffa44d7ba58919bfcb5d0e0853ee40c4d4473cd17091f702633bbb50a467d528589b246db090fc89dc80a510
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 3b9b97d120db7f17a3746dbd6cba32fd7f644466faeee9ab301b4e219b379422
MD5 9db213fab3e423e2916e495cb2df43a7
SHA1 7cff34bea44e7907ad9cd1150b61f804ba4aa6ff
SHA512 7bcb3fd4e872aa39612b3b805f93d1835b87aa78d6db3a1073e5006acaad2e08c671e741ac4c4134d3d744863d07446b95f0d2cde46b8f6ddf12484b89d4e311
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 ef52d547b172d6c5334687872f40f5b908ec78ea37df414bf80d79ee3e22de5e
MD5 29624a08b82f4ae51ef52afc7ce0870f
SHA1 babfbe73fa8fd35221a02ab287bd8ad073f9e719
SHA512 1f6410da7d6b7dc5d047c7323ef72a84c78e305c6e2ad1372e337855baad4ebb0fcd1e30afc4aa1b4cf6c682beefb24d54e52fd705d2d8df6cf2895fe15a3d2a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 348ffeb422c90c65a85d15c2510534f623adbb068911da794ee101875f1ed676
MD5 923b7e3cee3ac5fcbdf3903060b1bde7
SHA1 dbe0e2edaf305df38daec721de947cbdbc50adbc
SHA512 011006c23c60dd1092c8d188f68df77dcf3006b7eacadb90d6b162f177d4c00de85292c6055a302df0e3fc74b204fabed7eb1be4250bc7aeff455d224f5fc61a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 46f701f55db2f0c1fecf86c01e42eaa84fcb3bd8fdca082e6536f7797777cc1a
MD5 87076b6a7cf4185c9e0766e1a4e2637e
SHA1 5fb7819cf649e86cb0127c13651ff97ad4b7c2ef
SHA512 a76f42f9095be4ac5c484fe914e7027406f55cf7c8ce389ab59304ebf30316d0cb76340deadcc14ca057a29443dbf3a8aa2378988f2d5822b66ceb8325459358
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 55e8718a9a962fb9bdcdcb6882dbb83a7a9844436e02cf21a561f89f2c04ca20
MD5 55751bf3bd2ef5a8ba008c6ce010e90b
SHA1 5fe35c135dd0ea8e910168d97748d01e15d59335
SHA512 948effb3a279e69ac4a9533c5a50047db1c1ee800091334cde5f9733f42ca37a7f1bddc5354c7fa80eaf8c9b603e65e88c682e69b40f2baf567f2e1c4ecf56ee
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 30ee5a7bff3d606c41c101259d869a568fa41bb6c2b99fead7dcd43176227859
MD5 2277a2f2bd00eec60fc4c30bf8c83a20
SHA1 e3c92d9fca6e47b685b3686a1190fd33a4ab8e82
SHA512 e255a57e291bf356bca578791836ca2b1c835b1cc2ae0381d78d52dc74964b13eac990af04f30a10f8e832206666e318226869e88b44e28b03d067582a519cae
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 77e2bb1e238dc9f3c1b20c399038dd065c1e9d4a30a049cd877ee569b5c9cc64
MD5 18d5f20d9d61fde2604b7f84f7c9b90d
SHA1 89c15f6465ec2a8c51c4d83296790d9476befe12
SHA512 3b4be2cc6e94056001ee3282230ceffffc16d3d493adaa415e5dddd752c053bf3580bb82bc692494e0b34a14adb992fd08d1acda279475b3116c8308b73bb94f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 302237f0781ec732eebf0645f4b172403d9181d3bbd7492a753d2ae40654a223
MD5 57902e18259014a87652f4756451448f
SHA1 41a234463e5dab060ff315a4cfa6824cb0132fb0
SHA512 77d2db975870847f0c7e869865e758c996e326c25b0b0208c237a0c5c58b99ee6109a881b4b8db5c9624d9c7835715a2286bcee1a530b3f66de436debe0855fa
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 c5e61f8799021e2f171960d531d7abf9394fe1bc9745a2c67ed779d884a20986
MD5 324fd7d952bcbacad8c58485912cda59
SHA1 a46f96b41b79c5c32d47ad55537922193f6d9a00
SHA512 b3638ebdcb8aa7ef5108e4004a69ffdb5ac4b8efee6e6a54d5a9ff292ab1789c0601ce78703994528525e73557a811c06aa42e75e2c64a4aa5bb34f194093b5d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 24d4f4d73421ee9381fb0ed562f8e25259776b0abd6147cabf1a52a48d9eb367
MD5 d4cf9e09d596133b0383200b155a0393
SHA1 993d87a9c5c19570c8bf74e2937ea3526dc083f5
SHA512 d96d6e51d15d2e1043b6fa2f16dfa15c5d12ad70261e2327515bfdeabf2af7daaeee46411d135a58540f4d6d00207d6c59a4e0587a875835c062f017e21b9736
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ef03.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ef03.TMP
Size 539B
SHA256 a397ff3e3696c33247e470063debc7e8806550b9330fe03f67fbe04c280a9bc7
MD5 45ca64b0ee3711d113c71370f17c117a
SHA1 0955d9ccaf1002bb9c1fec969fb0823800dbc130
SHA512 07f42313378ec8295610c2ad5c48d331dcab6f4cb71b01f726eb655b9c14e0d8a6e81ebdff5a6f3891ac205979a85323e5fae20a7ae6d05e6262fa3ae22a3215
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4a4eadea76a6dbe89f704cbaa829cc4295aebc51317241246f31fc603985980d
MD5 fe118fb73a512ccea3f3c86f942bebe8
SHA1 25a03a1e0856981c643a493ac902d3e6a183bd3b
SHA512 b2820ae595d263af7f131e1f8a38ea8f9a14443e8a23fdd76f220a3d84e07698c66898fa7172daa85458f115094ceded883d2254d087985e33c610b94f244de3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxqe2RUUITbOfYOxhZHnqTS:A9iIxuERzA83h09RZxYxkkAxTHqTMTwQ
MD5 SHA1 SHA512 SSDEEP

Submit Download